ci(publish): stage, tag and release on a package.json version bump

[simoncrypta]

What

publish.yml now runs when a package.json change lands on main, instead of when a GitHub release is published.

• resolve job: reads the version and checks whether v<version> already exists on the remote. If it does (for example a dependency-only package.json change), nothing else runs.
• publish job, when the tag is missing:
  1. Extracts the ## <version> CHANGELOG section. If it's missing or empty, the job fails before staging anything.
  2. Runs vp check, vp test and vp run smoke.
  3. Stages the npm publish with vp pm stage publish. The dist-tag logic is unchanged.
  4. Runs gh release create v<version> --target <merged sha> with that CHANGELOG section as the notes. A version with a - becomes a prerelease (not latest); otherwise the release is marked latest.
• workflow_dispatch: kept as the manual way to re-stage. It also creates the tag and release if they're missing.
• Concurrency: a publish concurrency group means two quick merges don't race.

The release flow becomes: open a release PR (bump the version, rename ## Unreleased → ## <version>), merge it, then approve the staged publish with 2FA (vp pm stage approve <stage-id>).

Why the release trigger is removed

With release: published, publishing a release staged the same version a second time. 0.3.0 was already staged through workflow_dispatch, so a release created by hand would have staged it again. The release is now an output of the workflow, created with GITHUB_TOKEN, so it doesn't trigger other workflows.

Notes

• The file name stays publish.yml, because the npm Trusted Publisher (OIDC) is bound to it.
• Permissions: resolve gets contents: read. publish gets contents: write, to create the tag and release, and id-token: write.
• This PR doesn't touch package.json, so merging it won't run the workflow.
• v0.3.0 is already tagged on 02da986 and has a draft release. It's a draft because the old trigger would have re-staged 0.3.0. After this merges, it can be published by hand without starting a publish. Later versions are tagged and released by the workflow.
• AGENTS.md (packaging checklist) and the preview.yml comment now describe the new flow.

Checks

• vp check: pass.
• The workflow YAML parses.
• I dry-ran the resolve and CHANGELOG logic locally:
  • 0.3.0: tag exists, so the run would be skipped.
  • A version with no CHANGELOG section: the job fails before staging.
• actionlint isn't installed locally, so it wasn't run.
• The real end-to-end test is the next version-bump merge.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 9100a4e7-200a-43a8-a8d0-d2fb0cf7256f

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@cedarjs/pg@53

commit: 2d76c81