chore: bump to 1.7.0 (native codex hooks passthrough) #4

	name: Publish to npm

	on:
	push:
	tags:
	- "v*"

	permissions:
	contents: read
	id-token: write

	concurrency:
	group: publish-${{ github.ref }}
	cancel-in-progress: false

	jobs:
	publish:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v6

	- uses: actions/setup-node@v6
	with:
	node-version: "24"
	registry-url: "https://registry.npmjs.org"
	cache: npm

	- name: Verify tag matches package version
	run: \|
	package_version=$(node -p "require('./package.json').version")
	if [ "v$package_version" != "$GITHUB_REF_NAME" ]; then
	echo "Tag $GITHUB_REF_NAME does not match package.json version v$package_version" >&2
	exit 1
	fi

	- run: npm ci
	- run: npm run build
	- run: npm test
	- run: npm pack --dry-run

	- name: Publish (trusted publishing, idempotent)
	# Tokenless: configure this workflow as the package's trusted publisher
	# on npmjs.com; npm exchanges the job's OIDC identity (id-token: write)
	# for short-lived credentials. Provenance is attached automatically.
	# Requires npm >= 11.5.1 (Node 24 bundles npm 11).
	run: \|
	set -euo pipefail
	name=$(node -p "require('./package.json').name")
	version=$(node -p "require('./package.json').version")
	# Re-running the workflow for an already-published tag should be a
	# no-op, not a 409 failure.
	if npm view "${name}@${version}" version >/dev/null 2>&1; then
	echo "${name}@${version} already published — skipping"
	else
	npm publish
	fi

Navigation Menu