[Adi-ty]

What this PR does

Adds a workflow that publishes the npm workspaces (@rtcamp/wp-tooling, eslint-config, stylelint-config, tailwind-config) to npm from main. A release is a PR that bumps a package's version. Once it merges, the workflow publishes that version after a maintainer approves it. The versions on npm today were published by hand.

Changes

• .github/workflows/publish-npm-packages.yml, with three jobs:
  • plan lists workspaces whose version isn't on npm yet. A package that has never been published is skipped with a warning.
  • check runs npm run check, then npm publish --dry-run for each package, and fails if npm would auto-correct a manifest.
  • publish waits for approval in the npm environment, then publishes with npm trusted publishing (OIDC, no stored token, provenance attached). Prereleases go to the next tag.
• Hardened the way Gutenberg's publish workflow is:
  • no permissions by default, granted per job;
  • a protected environment;
  • no dependency cache;
  • pinned runner and action SHAs.
• @rtcamp/wp-tooling's bin is now bin/wp-tooling.js. npm auto-corrects the ./-prefixed form with a warning, which the check job treats as a failure.
• AGENTS.md describes the workflow and the bin rule.

How I verified

npm run check
actionlint .github/workflows/publish-npm-packages.yml
npm publish --workspace node-packages/wp-tooling --dry-run 2>&1 | grep -c auto-corrected

• npm run check passes (1,375 tests), and actionlint is clean.
• The grep prints 0 on this branch and 1 on main, so without the bin change the next wp-tooling release would fail the check job.
• Run locally, the plan step reports all four current versions as already on npm, so merging this publishes nothing.

Reviewer notes

• Rebased onto main now that feat(scaffolds)!: target rtcamp/wp-primitives ^2.0 #70 has merged.
• All four packages are already on npm, so the hand-published first version the workflow needs is in place. Before the workflow can publish, a repo or npm admin needs to:
  1. Create the npm environment with required reviewers, limited to main. Do this first: a job that names a missing environment creates it with no reviewers.
  2. Add the trusted publisher in each package's npm settings: rtCamp / wp-tooling / publish-npm-packages.yml / environment npm.
• split-npm-packages.yml keeps running for consumers that install from git URLs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Explicitly applying latest can move consumers to an accidentally downgraded package version.

Review effort: Balanced
Findings: 1

Open (1)

• Explicit latest tag permits stable version downgrades · New

What changed in this PR

Adds trusted npm publishing from main for all Node workspaces.

Changes:

• Adds planning, validation, approval, and OIDC publishing jobs.
• Normalizes the wp-tooling binary path.
• Documents npm release procedures.

File	Description
.github/​workflows/​publish-npm-packages.yml	Adds automated npm publishing.
node-packages/​wp-tooling/​package.json	Normalizes the binary path.
AGENTS.md	Documents npm publishing conventions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The preview and publish jobs can resolve different npm versions, undermining release reproducibility.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Explicit latest tag permits stable version downgrades

Previously missed (1)

In code that hasn't changed since last review

Pin npm version to ensure preview and publish are reproducible

.github/​workflows/​publish-npm-packages.yml:178

Using a semver range makes this preview non-reproducible: the check can install one npm release, then the approval-delayed publish job can resolve a newer release with different packing or manifest-normalization behavior. That breaks the stated guarantee that both jobs use the same npm and can let the real publish differ from the approved dry run. Pin the same exact npm version in both jobs.

This issue also appears on line 252 of the same file.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Registry publication depends on external environment protections and trusted-publisher configuration that require human verification.

Review effort: Balanced
Findings: None