From 89a81e4567a826a21066c8f5f326663e3590f053 Mon Sep 17 00:00:00 2001
From: Eric Viana <ericvsdefault@gmail.com>
Date: Mon, 27 Jul 2026 12:10:06 -0300
Subject: [PATCH] fix(ci): skip publish when the version is unchanged, and tag
 releases

Publish runs on every push to main and unconditionally calls `npm publish`, so any
merge that does not bump the version fails the run with:

  npm error You cannot publish over the previously published versions: 4.0.2.

That just happened twice, on #52 and #58. The noise matters: a permanently red
publish job is how blindpay-cli's genuinely broken publish went unnoticed for two
and a half months and left npm three versions behind.

This adds the same version guard already merged into blindpay-cli and blindpay-mcp,
so an unchanged version is a no-op instead of a failure.

Also tags and creates a GitHub release on publish. This repo has published up to
4.0.2 on npm and has zero git tags, so there is currently no way to see what
shipped in a release from the repo alone.

Two notes, neither addressed here:
- `.changeset/` has around 20 accumulated changeset files and no workflow consumes
  them, so version bumps are effectively manual edits to package.json. Worth either
  wiring up `changeset version` or dropping changesets.
- main currently carries the #52 and #58 fixes at an unbumped 4.0.2, so they are
  unreleased. The next version bump ships them.

Claude-Session: https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs
---
 .github/workflows/publish.yaml | 34 ++++++++++++++++++++++++++++++++--
 1 file changed, 32 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index a9d8896..bc7b02a 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -19,7 +19,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
         with:
-          ref: ${{ github.head_ref }}
           fetch-depth: 0
 
       - name: Setup Bun
@@ -33,11 +32,42 @@ jobs:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Resolve version
+        id: version
+        run: echo "value=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
+
+      # This runs on every push to main, so skip an unchanged version instead of
+      # failing the run on "cannot publish over the previously published version".
+      - name: Check whether version is already published
+        id: published
+        run: |
+          if npm view "@blindpay/node@${{ steps.version.outputs.value }}" version >/dev/null 2>&1; then
+            echo "value=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install dependencies
+        if: steps.published.outputs.value == 'false'
         run: bun install --frozen-lockfile
 
       - name: Build package
+        if: steps.published.outputs.value == 'false'
         run: bun run build
 
+      # Auth comes from npm trusted publishing (OIDC), enabled by id-token: write.
+      # Do not add NODE_AUTH_TOKEN: it writes an _authToken into .npmrc, which
+      # takes precedence over the OIDC exchange and fails with E404.
       - name: Publish package
-        run: npm publish
\ No newline at end of file
+        if: steps.published.outputs.value == 'false'
+        run: npm publish
+
+      - name: Tag and create release
+        if: steps.published.outputs.value == 'false'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="v${{ steps.version.outputs.value }}"
+          git tag "$TAG"
+          git push origin "$TAG"
+          gh release create "$TAG" --title "$TAG" --generate-notes