[thdxr]

Issue for this PR

Closes #

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This week's CI lockdown deleted OPENCODE_APP_ID/OPENCODE_APP_SECRET, bound npm trusted publishing to the release environment and limited pushes to v1 and v* tags. With those changes, every v1 publish.yml run fails, previews included. This PR makes v1 releasable with the smallest change.

• App token removed from all 6 jobs. GitHub release create, asset uploads, latest*.yml uploads and gh release edit --latest use github.token (the workflow already has contents: write). Git identity comes from the existing AUR step (opencode <opencode@sst.dev>).
• Tag and version sync push to v1 use the RELEASE_TAG_KEY deploy key, set through actions/checkout ssh-key in publish, only on versioned runs. The v* tag ruleset already allows deploy keys. DeployKey was added to the v1 ruleset (25933885) bypass list so the sync release versions commit can land.
• publish runs in release on v1, for previews too, because npm trusted publishing now only accepts that environment.
• Homebrew pushes to anomalyco/homebrew-tap over SSH with HOMEBREW_TAP_DEPLOY_KEY, like dev. github.token can't push to another repo.
• Apple: sign-cli-macos and the macOS build-electron legs run in release on v1 and read APPLE_SIGNING_CERTIFICATE (no password), APPLE_NOTARY_KEY and vars APPLE_NOTARY_KEY_ID/APPLE_NOTARY_ISSUER_ID when present. Otherwise they fall back to the current repo-level APPLE_CERTIFICATE/_PASSWORD/APPLE_API_KEY_PATH/APPLE_API_KEY/APPLE_API_ISSUER. This works before and after the move. Windows legs keep their current Azure login subject (no environment).
• latest.json (signed with the Tauri updater key, used only by legacy Tauri desktop installs) is skipped when TAURI_SIGNING_PRIVATE_KEY is unset. That key was deleted. Without this change, script/publish.ts would throw after npm publish and before tagging, leaving a half-finished release.

Not changed, still needs attention:

• nix-hashes.yml on v1 still uses the app token, so it will fail on the post-release sync commit. This doesn't block releases.
• Beta (opencode-beta) releases need a cross-repo token and won't work with github.token.
• Releases published with github.token don't trigger release: released workflows (Discord notify).

How did you verify your code works?

• actionlint (no new findings; runner-label warnings only), bun build --no-bundle on both scripts.
• Ran a preview publish.yml dispatch on a copy of this branch with the publish job disabled (results in the PR comments). Release-environment paths (deploy keys, new Apple names, npm OIDC) can only be exercised on v1. The first push to v1 after merge runs a preview, which checks npm publish in release.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[thdxr]

Dry run: preview publish.yml dispatch of this change on v1-release-dryrun (this branch plus publish: if: false): https://github.com/anomalyco/opencode/actions/runs/40545836295

• passed: version, build-cli, sign-cli-macos (codesign + verify + smoke test), build-electron macOS x64/arm64 and Linux x64/arm64. No app token was used anywhere.
• failed: sign-cli-windows and both Windows build-electron legs, at Azure login (AADSTS7002131, no federated credential for subject ref:refs/heads/v1-release-dryrun). The Azure credential is scoped to specific refs, so this is expected off v1 and not caused by this PR. The Windows jobs are unchanged apart from dropping the app token.
• not exercised (only possible on v1): the release environment (npm OIDC publish, new Apple secret names, RELEASE_TAG_KEY/HOMEBREW_TAP_DEPLOY_KEY pushes), GitHub release upload with github.token.

— from 𝕺𝖕𝖊𝖓𝕮𝖔𝖉𝖊