ci: streamline release publishing

.github/workflows/publish.yml

@@ -4,20 +4,30 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing release tag to publish
+        required: true
+        type: string
 
 permissions:
   contents: read
 
 concurrency:
-  group: publish-${{ github.ref }}
+  group: publish-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
   cancel-in-progress: false
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
     steps:
       - name: Check out
         uses: actions/checkout@v4
+        with:
+          ref: ${{ env.RELEASE_TAG }}
 
       - name: Set up Node
         uses: actions/setup-node@v4
@@ -38,27 +48,28 @@ jobs:
         run: |
           set -euo pipefail
 
+          if [[ ! "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Release tag ${RELEASE_TAG} is not a supported version tag."
+            exit 1
+          fi
+
           package_version="$(node -p "require('./package.json').version")"
-          tag_version="${GITHUB_REF_NAME#v}"
+          tag_version="${RELEASE_TAG#v}"
 
           if [[ "${tag_version}" != "${package_version}" ]]; then
-            echo "Tag ${GITHUB_REF_NAME} does not match package.json version ${package_version}."
+            echo "Tag ${RELEASE_TAG} does not match package.json version ${package_version}."
             exit 1
           fi
 
-      - name: Typecheck
-        run: npm run typecheck
-
-      - name: Test
-        run: npm test
-
       - name: Build
         run: npm run build
 
       - name: Verify isolated package install
         run: npm run verify:package-closure
 
       - name: Publish to npm
-        run: npm publish
+        # Full typecheck and test coverage run on pull requests and main.
+        # This tag job publishes only the artifact built and verified above.
+        run: npm publish --ignore-scripts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package.json

@@ -100,9 +100,7 @@
     "test": "node scripts/run-tests.mjs",
     "coverage:render": "node --import tsx scripts/render-coverage.ts",
     "verify:package-closure": "node tools/verify-package-closure.mjs",
-    "emit-causal-fixture": "tsx src/runtime/emit-causal-fixture.ts",
-    "hooks:install": "node .githooks/install.mjs",
-    "prepare": "node .githooks/install.mjs"
+    "emit-causal-fixture": "tsx src/runtime/emit-causal-fixture.ts"
   },
   "engines": {
     "node": ">=22.19.0"