chore(deps): patch hono, and drop two overrides that pinned nothing (… #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish (npm) | |
| # Why this exists: publishing was 100% manual — `npm publish` run from a laptop, | |
| # which hits the account's "2FA for writes" gate and demands an interactive OTP | |
| # every release. This automates it: CI publishes with an automation NPM_TOKEN + | |
| # --provenance, guarded by a version check so a re-run can never double-publish. | |
| # Mirrors blockrun-mcp/.github/workflows/publish.yml (npm half only — ClawRouter | |
| # is not an MCP server, so there is no MCP-registry step). | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "package.json" # only run when the version could have changed | |
| - ".github/workflows/publish.yml" | |
| workflow_dispatch: # manual trigger (e.g. to unstick a failed publish) | |
| concurrency: | |
| group: publish | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for npm --provenance attestation | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "22" | |
| registry-url: "https://registry.npmjs.org" | |
| - name: Resolve versions | |
| id: v | |
| run: | | |
| PKG=$(node -p "require('./package.json').version") | |
| NPM=$(npm view @blockrun/clawrouter version 2>/dev/null || echo "none") | |
| echo "pkg=$PKG" >> "$GITHUB_OUTPUT" | |
| echo "npm=$NPM" >> "$GITHUB_OUTPUT" | |
| echo "package.json=$PKG | npm=$NPM" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build, typecheck, test | |
| run: | | |
| npm run build | |
| npm run typecheck | |
| npm test | |
| - name: Publish to npm | |
| if: steps.v.outputs.pkg != steps.v.outputs.npm | |
| run: npm publish --provenance --access public | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Skip npm (already published) | |
| if: steps.v.outputs.pkg == steps.v.outputs.npm | |
| run: echo "npm already at ${{ steps.v.outputs.pkg }} — skipping npm publish" |