From 975dcf2f11bd1225a23ff4dadbd4aee430539ec5 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Fri, 10 Jul 2026 19:10:16 +0000
Subject: [PATCH 1/3] Initial plan


From e03e3bbafd2aa60d515e0688b1aeff9179814bc5 Mon Sep 17 00:00:00 2001
From: "anthropic-code-agent[bot]" <242468646+Claude@users.noreply.github.com>
Date: Fri, 10 Jul 2026 19:11:10 +0000
Subject: [PATCH 2/3] fix: move npm publish into release-please workflow to
 avoid GITHUB_TOKEN trigger suppression

Agent-Logs-Url: https://github.com/Primajin/Gyros/sessions/cb280944-3ee1-4aca-85f4-1984d38b03a3

Co-authored-by: Primajin <1742115+Primajin@users.noreply.github.com>
---
 .github/workflows/npm-publish.yml    |  3 +--
 .github/workflows/release-please.yml | 28 ++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 134ca95..15de360 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -1,8 +1,7 @@
 name: Publish to npm
 
 on:
-  release:
-    types: [published]
+  workflow_dispatch:
 
 permissions:
   contents: read
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 90b4476..3994451 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -9,6 +9,7 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
+  id-token: write
 
 jobs:
   release-please:
@@ -21,3 +22,30 @@ jobs:
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-npm:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    environment: npm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Publish to npm
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From a78e01ec74efb02cebccacabad53eccff95d2961 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 19:48:31 +0000
Subject: [PATCH 3/3] fix: add least-privilege job-level permissions to
 publish-npm job

Co-authored-by: Primajin <1742115+Primajin@users.noreply.github.com>
---
 .github/workflows/release-please.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 3994451..c2c3348 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -28,6 +28,9 @@ jobs:
     if: needs.release-please.outputs.release_created == 'true'
     runs-on: ubuntu-latest
     environment: npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7