From 0000e69d7fe31c10a19504ee4cde5671957724f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Simon=20Ba=CC=88chler?= <b@chler.com>
Date: Mon, 6 Jul 2026 23:34:30 +0200
Subject: [PATCH] fix: Github publish jobs

---
 .github/workflows/publish.yml | 25 +++++++++++++++++++------
 .github/workflows/release.yml | 12 ++++++++++++
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 361fa39..6c8bfa8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,27 +1,40 @@
 name: Publish Package
 
 on:
+  # Direct trigger used by the release workflow (and available manually).
+  # The release workflow cannot rely on the `release` event below: releases
+  # created with the default GITHUB_TOKEN do not trigger other workflows.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Git tag to publish (e.g. v0.2.12)'
+        required: true
+        type: string
+  # Still fires for releases created manually in the GitHub UI or with a PAT.
   release:
     types: [published]
 
 permissions:
   contents: read
+  # Required for npm trusted publishing (OIDC) and provenance.
   id-token: write
 
 jobs:
   publish:
-    if: startsWith(github.event.release.tag_name, 'v')
+    if: startsWith(inputs.tag || github.event.release.tag_name, 'v')
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository (fetch all tags)
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
       - name: Resolve tag to publish
         id: tag
         run: |
-          echo "tag=${{ github.event.release.tag_name }}" >>"$GITHUB_OUTPUT"
+          echo "tag=${{ inputs.tag || github.event.release.tag_name }}" >>"$GITHUB_OUTPUT"
+
+      - name: Checkout repository at the release tag
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ steps.tag.outputs.tag }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3af6262..25a696b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,8 @@ on:
 
 permissions:
   contents: write
+  # Needed to dispatch the publish workflow at the end of the release job.
+  actions: write
 
 jobs:
   release:
@@ -74,3 +76,13 @@ jobs:
           else
             gh release create "$TAG" --title "$TAG" --notes-file RELEASE_NOTES.md
           fi
+
+      # Releases created with the default GITHUB_TOKEN do not trigger the
+      # `release: published` event in other workflows (GitHub's recursion
+      # guard), so the publish workflow must be dispatched explicitly.
+      # workflow_dispatch is exempt from that guard.
+      - name: Trigger npm publish workflow
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.release.outputs.tag }}
+        run: gh workflow run publish.yml --ref main -f tag="$TAG"