ci: publish on version change instead of via release-please

.github/workflows/release.yml

@@ -1,51 +1,61 @@
 name: Release
 
-# Release PR -> merge -> publish.
+# Publish on version change.
 #
-# release-please keeps a version-bump + changelog PR open against master. Merging
-# it tags the release and triggers the publish job below. Nothing publishes until
-# that PR is merged, so this workflow is inert on ordinary pushes.
+# When package.json's version is not yet on npm, the publish job runs. The bump
+# arrives as an ordinary pull request opened by a person or an agent — GitHub
+# Actions never creates a pull request here, so this needs none of the
+# "Allow GitHub Actions to create and approve pull requests" permission that
+# blocked the previous release-please setup.
 #
-# Publishing uses npm Trusted Publishing (OIDC): there is no NPM_TOKEN anywhere.
-# It requires a one-time setup on npmjs.com —
+# So the flow is: open a version-bump PR -> merge it -> this publishes.
+# Pushes that do not change the version are a no-op.
+#
+# Publishing uses npm Trusted Publishing (OIDC), so no NPM_TOKEN exists in this
+# repository. It requires one-time setup on npmjs.com:
 #   @pathscale/ui -> Settings -> Trusted Publisher -> GitHub Actions
 #   repository: pathscale/ui, workflow: release.yml
-# Until that is configured the publish step fails closed; it cannot publish
-# unsigned or unauthenticated.
+# Without it the publish step fails closed rather than publishing unauthenticated.
 
 on:
   push:
     branches: [master]
+  workflow_dispatch: # manual re-run, e.g. if a publish failed after the build
 
 permissions:
   contents: read
 
 jobs:
-  release-please:
+  check:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     outputs:
-      release_created: ${{ steps.release.outputs.release_created }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.decide.outputs.version }}
+      publish: ${{ steps.decide.outputs.publish }}
     steps:
-      # Version baseline comes from .release-please-manifest.json, not from git
-      # tags: the newest tag here is v1.1.51 while npm is on 1.2.11, so tag-derived
-      # versioning would propose a version below what is already published.
-      - uses: googleapis/release-please-action@v4
-        id: release
-        with:
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
+      - uses: actions/checkout@v4
+
+      - name: Is package.json's version already on npm?
+        id: decide
+        run: |
+          version="$(node -p "require('./package.json').version")"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          # Query the exact version rather than `latest`, so re-runs are idempotent
+          # and backfilling an older version is still recognised as published.
+          if npm view "@pathscale/ui@$version" version >/dev/null 2>&1; then
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::@pathscale/ui@$version is already on npm — nothing to publish"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::@pathscale/ui@$version is not on npm — publishing"
+          fi
 
   publish:
-    needs: release-please
-    if: needs.release-please.outputs.release_created == 'true'
+    needs: check
+    if: needs.check.outputs.publish == 'true'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write # required for OIDC trusted publishing + provenance
+      contents: write # create the git tag and GitHub release after publishing
+      id-token: write # OIDC trusted publishing + provenance
     steps:
       - uses: actions/checkout@v4
 
@@ -86,7 +96,7 @@ jobs:
       - name: Build
         run: bun run build
 
-      # ---- pre-publish gates. A version can never be reused; fail before shipping.
+      # ---- gates. A version can never be reused, so fail before shipping.
 
       - name: Package check (exports and README resolve against the tarball)
         run: bun run check:package
@@ -99,3 +109,15 @@ jobs:
 
       - name: Publish to npm
         run: npm publish --provenance --access public
+
+      # Tags here have drifted from reality in the past (newest was v1.1.51 while
+      # npm was on 1.2.11). Tagging as part of publishing keeps them honest.
+      - name: Tag the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.check.outputs.version }}
+        run: |
+          gh release create "v$VERSION" \
+            --title "v$VERSION" \
+            --generate-notes \
+            --verify-tag=false