fix(npm): publish automation not running for releases created by Release Please

[Claude]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Fix npm publish automation not running for releases created by Release Please</issue_title>
<issue_description>## Summary
The v1.1.0 GitHub release was created successfully, but the npm publish automation did not run, so the package was not published from the release pipeline.

Observed behavior

• Release PR #37 (chore(main): release 1.1.0) merged successfully.
• A published GitHub release exists for v1.1.0.
• The repository contains a dedicated npm publish workflow at .github/workflows/npm-publish.yml.
• No Publish to npm workflow run appears to have started for the v1.1.0 release.
• The release commit shows other checks/workflows completed, but not npm publish.

Investigation findings

Relevant workflow configuration

release-please.yml currently creates releases from the main branch using the default GitHub token:

name: Release Please

on:
  push:
    branches:
      - main

permissions:
  contents: write
  issues: write
  pull-requests: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

npm-publish.yml currently relies only on the GitHub release event:

name: Publish to npm

on:
  release:
    types: [published]

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'
      - name: Install dependencies
        run: npm ci
      - name: Build
        run: npm run build
      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Likely root cause

The release is being created by googleapis/release-please-action using ${{ secrets.GITHUB_TOKEN }}. GitHub suppresses many follow-up workflow triggers caused by events generated from the default workflow token to prevent recursive automation. As a result, the published release exists, but the second workflow listening on release.published never starts.

Evidence gathered

• Published release exists: v1.1.0
• Release URL: https://github.com/Primajin/Gyros/releases/tag/v1.1.0
• Release author: github-actions[bot]
• Release target commit: b3702bed709ed39d6c58611d6eb00686f68f6b75
• Release PR touched only release metadata/files (CHANGELOG.md, package.json, package-lock.json, .release-please-manifest.json)
• Recent workflow runs include Release Please, Test, Lint, Deploy, CodeQL, etc., but no Publish to npm run for the release
• Check runs on the release commit show only 6 checks and do not include npm publish

Proposed fix

Move npm publishing into release-please.yml itself so publishing happens in the same workflow run when release_created == 'true', instead of relying on a separate workflow triggered by the release event.

Recommended implementation

1. Add id-token: write to top-level permissions in release-please.yml
2. Add a publish-npm job to release-please.yml with:
   • needs: release-please
   • if: needs.release-please.outputs.release_created == 'true'
   • environment: npm
   • steps for checkout, setup-node, npm ci, npm run build, and npm publish --provenance --access public
3. Change .github/workflows/npm-publish.yml to manual-only with workflow_dispatch, or remove it if no manual backstop is desired

Suggested resulting release-please.yml

name: Release Please

on:
  push:
    branches:
      - main

permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write

jobs:
  release-please:
    runs-on: ubuntu-latest
    outputs:
      release_created: ${{ steps.release.outputs.release_created }}
      tag_name: ${{ steps.release.outputs.tag_name }}
    steps:
      - uses: googleapis/release-please-action@v5
        id: release
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

  publish-npm:
    needs: release-please
    if: needs.release-please.outputs.release_created == 'true'
    runs-on: ubuntu-latest
    environment: npm
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Suggested resulting npm-publish.yml

name: Publish to npm

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: npm
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '24'
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

      - name: Publish to npm
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Acceptance criteria

• When a release is created by release-please, npm publishing runs in the same workflow execution
• The publish job only runs when a new release is actually created
• The publish job uses the existing NPM_TOKEN secret and OIDC provenance
• Future releases no longer depend on release.published firing from a release created by GITHUB_TOKEN
• Either:
  • .github/workflows/npm-publish.yml is converted to workflow_dispatch, or
  • the redundant workflow is removed intentionally

Additional notes

• The current failure mode is silent from the npm publish workflow perspective because the workflow is never triggered at all.
• This issue is about fixing future releases. v1.1.0 may still need a one-time manual publish if it was not already published to npm.
• Attempting to push the fix from Copilot failed due to missing write permissions, so implementation should be done by a maintainer or another agent with repo write access.</issue_description>
• Closes Fix npm publish automation not running for releases created by Release Please #38

Comments on the Issue (you are @claude[agent] in this section)

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://Primajin.github.io/Gyros/pr-preview/pr-39/
Built to branch gh-pages at 2026-07-10 19:53 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

2026-07-10T19:19:25.107Z-iPad_Pro_landscape-b6ce62b.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.19.25.107Z-iPad_Pro_landscape-b6ce62b.png

2026-07-10T19:19:25.107Z-iPad_Pro-b6ce62b.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.19.25.107Z-iPad_Pro-b6ce62b.png

2026-07-10T19:19:25.107Z-iPhone_13-b6ce62b.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.19.25.107Z-iPhone_13-b6ce62b.png

[github-actions]

Console Logs

✅ No logs were captured

[Copilot]

Pull request overview

This PR fixes npm publish automation not running for GitHub Releases created by Release Please (where release.published-triggered workflows may not fire when the release is created via GITHUB_TOKEN) by running the npm publish steps within the same release-please workflow execution.

Changes:

• Add an npm publish job to release-please.yml, gated on release_created == 'true', so publishing happens in the same workflow run that creates the release.
• Add id-token: write to support npm publish --provenance.
• Convert the standalone npm-publish.yml workflow from release.published to workflow_dispatch (manual backstop).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release-please.yml	Adds an in-workflow publish-npm job so npm publishing runs during Release Please when a release is created.
.github/workflows/npm-publish.yml	Switches publish workflow trigger to manual-only to avoid relying on release.published for Release Please-created releases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Primajin]

@copilot please address the comment

[Copilot]

@copilot please address the comment

Added job-level permissions to the publish-npm job that override the workflow-level permissions — restricting it to contents: read and id-token: write. This ensures the write-capable GITHUB_TOKEN granted at the workflow level (contents: write, issues: write, pull-requests: write) is not available to the job running npm ci. Addressed in commit fix: add least-privilege job-level permissions to publish-npm job.

[github-actions]

2026-07-10T19:56:20.905Z-iPad_Pro_landscape-7018692.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.56.20.905Z-iPad_Pro_landscape-7018692.png

2026-07-10T19:56:20.905Z-iPad_Pro-7018692.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.56.20.905Z-iPad_Pro-7018692.png

2026-07-10T19:56:20.905Z-iPhone_13-7018692.png

• https://github.com/Primajin/Gyros/releases/download/temp/2026-07-10T19.56.20.905Z-iPhone_13-7018692.png