[mangelsnc]

Context

v2.3.0 was tagged on GitHub but never reached npm. The publish call failed with:

404 Not Found - PUT https://registry.npmjs.org/undisclosed
'undisclosed@2.3.0' is not in this registry.

Per the npm Trusted Publishing docs:

When GitHub Actions workflows use workflow_call or workflow_dispatch for publishing, validation checks the calling workflow's name, not the workflow containing the publish command.

This explains the 404: the dispatch-triggered run could not pass npm's calling-workflow validation, even though sigstore signed the provenance (sigstore does not enforce that validation; npm does).

Fix

• Trigger is push: tags: '[0-9]+.[0-9]+.[0-9]+'. The recommended pattern from the official npm docs, adapted to our historical tag convention.
• workflow_dispatch and force_publish are removed.
• New step verifies that the pushed tag matches package.json version before doing anything.
• The workflow no longer creates the tag — the tag IS the trigger. The release engineer bumps package.json, commits, merges to main, and pushes a tag. The workflow does the rest (lint, test, build, GitHub Release, npm publish --provenance --access public).

Tag naming

v2.3.0 was tagged as v2.3.0. That broke the repo's historical convention (1.0.0 ... 2.2.0, no v prefix). This PR restores the convention and the new trigger pattern matches it.

Release procedure once this lands

git checkout main
git pull
git tag 2.3.1
git push origin 2.3.1

That triggers the workflow. npm gets undisclosed@2.3.1 with provenance; GitHub gets a 2.3.1 Release.

v2.3.0 in npm

v2.3.0 stays as a GitHub Release/tag with no corresponding npm package. v2.3.1 has identical functional content. The v2.3.0 GitHub Release will be edited post-merge to point users at v2.3.1.

Test plan

• CI on this PR passes (ci.yml still on Node 16).
• After merge to main, push tag 2.3.1. The new workflow runs end-to-end, creates the GitHub Release, and publishes to npm with provenance.
• npm view undisclosed@2.3.1 version returns 2.3.1.
• npm view undisclosed dist-tags.latest returns 2.3.1.