Skip to content

chore(deps): patch hono, and drop two overrides that pinned nothing (… #75

chore(deps): patch hono, and drop two overrides that pinned nothing (…

chore(deps): patch hono, and drop two overrides that pinned nothing (… #75

Workflow file for this run

name: Publish (npm)
# Why this exists: publishing was 100% manual — `npm publish` run from a laptop,
# which hits the account's "2FA for writes" gate and demands an interactive OTP
# every release. This automates it: CI publishes with an automation NPM_TOKEN +
# --provenance, guarded by a version check so a re-run can never double-publish.
# Mirrors blockrun-mcp/.github/workflows/publish.yml (npm half only — ClawRouter
# is not an MCP server, so there is no MCP-registry step).
on:
push:
branches: [main]
paths:
- "package.json" # only run when the version could have changed
- ".github/workflows/publish.yml"
workflow_dispatch: # manual trigger (e.g. to unstick a failed publish)
concurrency:
group: publish
cancel-in-progress: false
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # required for npm --provenance attestation
steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
with:
node-version: "22"
registry-url: "https://registry.npmjs.org"
- name: Resolve versions
id: v
run: |
PKG=$(node -p "require('./package.json').version")
NPM=$(npm view @blockrun/clawrouter version 2>/dev/null || echo "none")
echo "pkg=$PKG" >> "$GITHUB_OUTPUT"
echo "npm=$NPM" >> "$GITHUB_OUTPUT"
echo "package.json=$PKG | npm=$NPM"
- name: Install dependencies
run: npm ci
- name: Build, typecheck, test
run: |
npm run build
npm run typecheck
npm test
- name: Publish to npm
if: steps.v.outputs.pkg != steps.v.outputs.npm
run: npm publish --provenance --access public
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- name: Skip npm (already published)
if: steps.v.outputs.pkg == steps.v.outputs.npm
run: echo "npm already at ${{ steps.v.outputs.pkg }} — skipping npm publish"