From 7658203703b251651c264db3a8ea9d736fd0a1d7 Mon Sep 17 00:00:00 2001
From: Daniel Kanas <dkanas95@gmail.com>
Date: Wed, 5 Aug 2026 23:22:59 +0200
Subject: [PATCH] Add release workflow publishing to npm

Runs on pushes to main, publishes only when the package.json version
changed, then tags the release. workflow_dispatch forces a publish.

Uses a push trigger rather than workflow_run. workflow_run grants write
permissions and OIDC access while running in the base repository, so
checking out the triggering run's head_sha would execute pull request code
from forks in a privileged context. A push to main cannot originate from a
fork.

Switches publishConfig from GitHub Packages to registry.npmjs.org with
public access. The previous target could not serve `npx @contractbook/mcp`,
which is what the README and the setup command tell users to run.

Aligns the CI workflow's action versions with the publish workflow.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml      |  8 ++---
 .github/workflows/publish.yml | 61 +++++++++++++++++++++++++++++++++++
 package.json                  |  3 +-
 3 files changed, 67 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 936067b..6e4406b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,13 +13,13 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
-          node-version: 24
+          node-version: "24"
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..aaf50af
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,61 @@
+name: Publish
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+      - name: Check version change
+        id: version
+        run: |
+          CURRENT=$(jq -r .version package.json)
+          echo "version=$CURRENT" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          PREVIOUS=$(git show HEAD~1:package.json | jq -r .version)
+          if [ "$CURRENT" = "$PREVIOUS" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+      - if: steps.version.outputs.changed == 'true'
+        uses: pnpm/action-setup@v5
+      - if: steps.version.outputs.changed == 'true'
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: pnpm
+          registry-url: "https://registry.npmjs.org"
+      - if: steps.version.outputs.changed == 'true'
+        run: pnpm install --frozen-lockfile
+      - if: steps.version.outputs.changed == 'true'
+        run: pnpm build
+      - if: steps.version.outputs.changed == 'true'
+        run: pnpm publish --no-git-checks --access public
+      - name: Create release tag
+        if: steps.version.outputs.changed == 'true'
+        env:
+          TAG: v${{ steps.version.outputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$TAG" -m "Release $TAG"
+          git push origin "$TAG"
diff --git a/package.json b/package.json
index a240e5f..b50598b 100644
--- a/package.json
+++ b/package.json
@@ -24,7 +24,8 @@
   ],
   "type": "module",
   "publishConfig": {
-    "registry": "https://npm.pkg.github.com"
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
   },
   "scripts": {
     "build": "vite build",