From cef833eabff669f7815aa2b1a2660b29d4c99137 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 8 Jul 2026 05:11:39 +0000
Subject: [PATCH] ci: trigger npm publish on Auto Tag completion, not just tag
 push

auto-tag.yml pushes release tags using the default GITHUB_TOKEN. GitHub
does not fire `push` events for refs pushed with GITHUB_TOKEN (to avoid
workflow recursion), so publish.yml's `on: push: tags: v*` trigger has
never actually fired for an automated tag.

Verified against live state: npm has only ever published v1.0.1, while
tags v1.0.2 and v1.0.3 exist on the remote and publish.yml's run history
contains zero tag-push-triggered runs since the auto-tag workflow was
introduced.

Add a `workflow_run` trigger that fires when the "Auto Tag" workflow
completes successfully (the same pattern auto-tag.yml already uses to
chain off of CI), and resolve the version from the tag pointing at that
commit when not triggered by a direct tag push.
---
 .github/workflows/publish.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 575daf9..05a457c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,6 +4,9 @@ on:
   push:
     tags:
       - 'v*'
+  workflow_run:
+    workflows: ["Auto Tag"]
+    types: [completed]
   workflow_dispatch:
 
 permissions:
@@ -14,8 +17,12 @@ jobs:
   publish:
     name: Build & Publish
     runs-on: ubuntu-latest
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
 
       - uses: actions/setup-node@v4
         with:
@@ -28,10 +35,18 @@ jobs:
 
       - name: Set version from tag
         run: |
-          # Use tag version if triggered by tag push, otherwise use package.json as-is
+          # Use tag version if triggered by tag push; otherwise (Auto Tag's
+          # workflow_run) resolve the newest v* tag pointing at this commit,
+          # since tags pushed with the default GITHUB_TOKEN don't fire `push` events.
           if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
             TAG_VERSION="${GITHUB_REF#refs/tags/v}"
+          else
+            TAG_VERSION=$(git tag -l 'v*' --sort=-version:refname --points-at HEAD | head -1 | sed 's/^v//')
+          fi
+          if [ -n "$TAG_VERSION" ]; then
             npm version "$TAG_VERSION" --no-git-tag-version
+          else
+            echo "::warning::No matching v* tag found at this commit; publishing package.json version as-is"
           fi
 
       - name: Build