ci: split manual npm package publishing workflow

Author: pchalamet

.github/workflows/on-release-published.yml

@@ -1,18 +1,7 @@
 name: 🌍 Release
-run-name: Release ${{ github.event.release.tag_name || github.event.inputs.version || github.ref_name }}
+run-name: Release ${{ github.event.release.tag_name }}
 
 on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release tag to publish, for example 0.74.0'
-        required: true
-        type: string
-      npm_only:
-        description: 'Only publish the audited npm tarball for the selected release'
-        required: false
-        default: false
-        type: boolean
   release:
     types: [published]
 
@@ -22,15 +11,14 @@ permissions:
   id-token: write
 
 concurrency:
-  group: release-publish-${{ github.event.release.tag_name || github.event.inputs.version || github.ref_name }}
+  group: release-publish-${{ github.event.release.tag_name }}
   cancel-in-progress: false
 
 env:
-  RELEASE_TAG: ${{ github.event.release.tag_name || github.event.inputs.version || github.ref_name }}
+  RELEASE_TAG: ${{ github.event.release.tag_name }}
 
 jobs:
   deploy-website:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     runs-on: ubuntu-latest
     environment:
       name: github-pages
@@ -73,7 +61,6 @@ jobs:
         uses: actions/deploy-pages@v4
 
   release-nuget:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     runs-on: ubuntu-latest
     steps:
       - name: Setup .NET
@@ -136,7 +123,6 @@ jobs:
           npm publish "${packages[0]}" --access public --provenance
 
   publish-vscode-marketplace:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -164,7 +150,6 @@ jobs:
         run: ./.github/scripts/publish-vscode-marketplace.sh
 
   publish-open-vsx:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -192,7 +177,6 @@ jobs:
         run: ./.github/scripts/publish-open-vsx.sh
 
   sign-and-notarize:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     runs-on: macos-latest
     steps:
       - name: Download unsigned macOS artifacts
@@ -265,12 +249,11 @@ jobs:
             }
 
   update-homebrew-tap:
-    if: ${{ github.event_name != 'workflow_dispatch' || github.event.inputs.npm_only != 'true' }}
     uses: ./.github/workflows/release-homebrew-tap.yml
     needs:
       - sign-and-notarize
     with:
-      ref: ${{ github.event.release.tag_name && format('refs/tags/{0}', github.event.release.tag_name) || github.event.inputs.version && format('refs/tags/{0}', github.event.inputs.version) || github.ref }}
-      version: ${{ github.event.release.tag_name || github.event.inputs.version || github.ref_name }}
+      ref: ${{ format('refs/tags/{0}', github.event.release.tag_name) }}
+      version: ${{ github.event.release.tag_name }}
       dry-run: false
     secrets: inherit

.github/workflows/publish-npm-release-asset.yml

@@ -0,0 +1,60 @@
+name: 📦 Publish npm Package
+run-name: Publish npm package ${{ github.event.inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release tag to publish, for example 0.74.0'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: npm-publish-${{ github.event.inputs.version }}
+  cancel-in-progress: false
+
+jobs:
+  publish-npm:
+    runs-on: ubuntu-latest
+    env:
+      RELEASE_VERSION: ${{ github.event.inputs.version }}
+      PACKAGE_NAME: '@magnusopera/fscript'
+    steps:
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Download npm package artifact
+        uses: robinraju/release-downloader@v1.11
+        with:
+          tag: ${{ env.RELEASE_VERSION }}
+          fileName: '*.tgz'
+
+      - name: Publish npm package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_KEY }}
+        run: |
+          if [[ -z "${NODE_AUTH_TOKEN:-}" ]]; then
+            echo "::error::NPM_KEY secret is not configured."
+            exit 1
+          fi
+
+          shopt -s nullglob
+          packages=(./*.tgz)
+          if [[ "${#packages[@]}" -ne 1 ]]; then
+            echo "::error::Expected exactly one audited npm .tgz release asset, found ${#packages[@]}."
+            exit 1
+          fi
+
+          if npm view "${PACKAGE_NAME}@${RELEASE_VERSION}" version >/dev/null 2>&1; then
+            echo "${PACKAGE_NAME}@${RELEASE_VERSION} is already published; skipping."
+            exit 0
+          fi
+
+          npm publish "${packages[0]}" --access public --provenance

CHANGELOG.md

@@ -4,6 +4,7 @@ All notable changes to FScript are documented in this file.
 
 ## [Unreleased]
 
+- Split manual npm package publishing into a dedicated workflow so release publication automation only runs on published releases.
 - Added npm publishing for the Fable JavaScript package when a release is published.
 - Added npm package tarballs to draft release assets so the JavaScript package can be audited before publishing.