ci: add CI and scheduled schema regeneration

[aggmoulik]

Problem

This repo has no CI and no regeneration automation. publish.yml on a tag is the only workflow — no type check or lint has ever run here. Keeping src/gen current is entirely manual: someone remembers to run deno task generate, bump the version, and tag.

There is also a version literal duplicated between deno.json and scripts/build_npm.ts, which can drift silently.

What this adds

file	change
.github/workflows/ci.yml	new — deno task check, deno task lint, deno fmt --check on PRs
.github/workflows/regen.yml	new — weekly cron + workflow_dispatch, regenerates and opens a PR when the schema moved
.github/workflows/publish.yml	if: github.repository == 'openstatusHQ/sdk-node' on both publish jobs
scripts/build_npm.ts	reads version from deno.json instead of a hardcoded "0.2.0"

Generation itself is unchanged. regen.yml calls the existing deno task generate → buf generate buf.build/openstatus/api. No change to buf.gen.yaml, no switch to a different mechanism.

Flow

weekly cron / workflow_dispatch
  ├─ setup deno + buf (buf-action, setup_only — buf is not a repo dependency)
  ├─ deno task generate          buf.gen.yaml resolves buf.build/openstatus/api:main
  ├─ deno fmt src/gen            committed tree is formatted; raw generator output is not
  ├─ deno task check             generated code must compile
  ├─ bump patch in deno.json     only if src/gen actually changed
  └─ create-pull-request         no-ops on a clean tree

No pinned marker file and no version parsing: buf generate resolves :main itself, so a diff appears exactly when the schema moved.

Verification

Dispatched against the current schema in a fork. Result — no PR, which is correct: this SDK was already regenerated by hand on 2026-07-27.

conclusion: success
PRs open:   none
bump step:  no schema change; skipping version bump

Two things had to be fixed to get there, both of which would otherwise have produced a large meaningless PR every week:

• deno fmt after generate. The committed src/gen is formatted; the generator emits unwrapped output. Without this step the diff showed 368 exports removed and the same 368 re-added, differing only in line wrapping.
• sed instead of jq for the version bump. jq re-serialises the whole of deno.json, expanding compact arrays and dirtying unrelated lines on every run.

Notes for review

• publish.yml fires on any tag push. Without the repository guard, a tag in a fork publishes a fork build to the real @openstatus/sdk-node on npm and JSR.
• The permissions block on regen.yml needs contents: write and pull-requests: write, and the repo setting Allow GitHub Actions to create and approve pull requests must be enabled — otherwise the PR step fails with GitHub Actions is not permitted to create or approve pull requests.
• PRs opened by the default GITHUB_TOKEN do not trigger on: pull_request, so ci.yml will not run on regen PRs. Setting a SDK_BOT_TOKEN secret fixes that; the workflow falls back to github.token when it is absent.