ci: automate Figma Code Connect publish + validate

[QuintonJason]

Description

Adds .github/workflows/code-connect.yml to keep the Figma Code Connect mappings
(libs/figma/*.figma.ts) in sync with Figma automatically.

Motivation / context: publishing was previously a manual, undocumented
local step — @figma/code-connect isn't even a declared dependency, so Dev
Mode was only ever as fresh as the last person who remembered to run
figma connect publish with a personal token. This closes that drift.

• PRs touching libs/figma/** or figma.config.json → figma connect parse
  (local validation only; no token, fork-safe) so a broken mapping fails the PR
  instead of silently shipping stale snippets.
• Merge to main / manual dispatch → figma connect publish, gated on the
  FIGMA_ACCESS_TOKEN secret with an explicit guard step that fails loudly if
  it's missing.

Also reclassifies pds-box and pds-text in CODE_CONNECT_COVERAGE.md: they
are not Code-Connectable (Code Connect attaches to a component node, and in
the Pine Figma file text is text styles and layout is auto-layout +
variables — neither is a component). Their code relationship is carried by the
pine-figma authoring skill's style/variable→code map instead. This stops them
being tracked as perpetual "todo" mappings.

New dependency / action required (admin): the publish job needs a
FIGMA_ACCESS_TOKEN repo secret — a Figma personal access token with Code
Connect write scope. Until it's added, publish fails with a clear error; the
parse PR gate needs nothing. The CLI is pinned via npx (CODE_CONNECT_VERSION)
rather than added to package.json, matching how it's run today; promoting it to
a pinned devDependency is a reasonable follow-up.

Fixes #(no issue)

Type of change

• New feature (non-breaking change which adds functionality) — CI automation
• This change requires a documentation update — CODE_CONNECT_COVERAGE.md updated

How Has This Been Tested?

• other: workflow YAML validated with js-yaml (parses; two jobs gate correctly on github.event_name). figma connect parse is a local no-network validation, so the PR gate is self-contained. The publish path is exercised on merge to main once the secret exists.

Test Configuration:

• Pine versions: n/a (CI/config only)
• OS: n/a
• Browsers: n/a

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing tests pass locally with my changes
• Design has QA'ed and approved this PR

---

Note

Low Risk
CI and documentation only; publish depends on a repo secret and fails loudly if missing, with no application runtime impact.

Overview
Adds .github/workflows/code-connect.yml so libs/figma/*.figma.ts mappings stay validated and published without manual figma connect publish runs.

PRs that touch libs/figma/**, figma.config.json, or the workflow run figma connect parse via pinned npx @figma/code-connect@1.5.3 with --exit-on-unreadable-files — local, no Figma token, fork-safe. Push to main and workflow_dispatch run publish, gated on a FIGMA_ACCESS_TOKEN guard step.

CODE_CONNECT_COVERAGE.md documents this pipeline and moves pds-box / pds-text out of the “not yet mapped” backlog into a primitives — not Code-Connectable section (no Figma component node; covered by the pine-figma style/variable map instead).

^{Reviewed by Cursor Bugbot for commit 1ca1f25. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for pine-design-system ready!

Name	Link
🔨 Latest commit	1ca1f25
🔍 Latest deploy log	https://app.netlify.com/projects/pine-design-system/deploys/6a7e5b5a8f346b000860cda1
😎 Deploy Preview	https://deploy-preview-794--pine-design-system.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[QuintonJason]

Addressed the Bugbot finding in 17f071d: added --exit-on-unreadable-files to both figma connect parse (PR gate) and figma connect publish (main). Without it the CLI can exit 0 while silently skipping an unparseable mapping — exactly the green-but-stale failure this workflow exists to prevent. Now a broken .figma.ts fails the PR instead of shipping.

[QuintonJason]

Good catch — addressed in 1ca1f25. --exit-on-unreadable-files is only respected for .figma.ts/.figma.js templates (our parser is html) from Code Connect 1.4.4 onward, so at the previous 1.3.4 pin it was a no-op. Bumped CODE_CONNECT_VERSION to 1.5.3 (current latest) and documented the 1.4.4 minimum inline so a future downgrade doesn't silently re-break the gate.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1ca1f25. Configure here.}

[cursor]

Nonexistent CLI version pin

High Severity

CODE_CONNECT_VERSION is pinned to @figma/code-connect@1.5.3, but that release is not on npm — latest is 1.5.2. Both npx steps resolve that package, so validate and publish fail on every run instead of parsing or publishing mappings.

 

^{Reviewed by Cursor Bugbot for commit 1ca1f25. Configure here.}

[QuintonJason]

False positive — 1.5.3 is live on npm. npm view @figma/code-connect@1.5.3 resolves (published 2026-08-12, tarball present) and dist-tags.latest → 1.5.3. The "latest is 1.5.2" appears to be a stale index; 1.5.2 shipped 2026-08-03, 1.5.3 nine days later. Keeping the pin at 1.5.3 (also comfortably ≥ the 1.4.4 required for --exit-on-unreadable-files to apply to .figma.ts).