Publish npm from release workflow

Author: nicko-ai

.github/workflows/build-tui.yml

@@ -187,3 +187,80 @@ jobs:
           fi
 
           gh release edit "$RELEASE_TAG" --draft=false --latest
+
+  publish-npm:
+    needs:
+      - prepare
+      - release
+    if: github.repository == 'VRSEN/OpenSwarm'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      NPM_CONFIG_PROVENANCE: false
+    steps:
+      - name: Checkout release tag
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.prepare.outputs.release_tag }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Validate release metadata
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
+          RELEASE_VERSION: ${{ needs.prepare.outputs.release_version }}
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${NODE_AUTH_TOKEN}" ]]; then
+            echo "NPM_TOKEN is required to publish to npm." >&2
+            exit 1
+          fi
+
+          if [[ "$RELEASE_TAG" != "v$RELEASE_VERSION" ]]; then
+            echo "Release tag ($RELEASE_TAG) must match release version ($RELEASE_VERSION)." >&2
+            exit 1
+          fi
+
+          package_version="$(node -p "require('./package.json').version")"
+          lock_version="$(node -p "require('./package-lock.json').packages[''].version")"
+          python_version="$(python3 - <<'PY'
+          import tomllib
+          with open("pyproject.toml", "rb") as handle:
+              print(tomllib.load(handle)["project"]["version"])
+          PY
+          )"
+
+          if [[ "$package_version" != "$RELEASE_VERSION" || "$lock_version" != "$RELEASE_VERSION" || "$python_version" != "$RELEASE_VERSION" ]]; then
+            echo "Release tag, package.json, package-lock.json, and pyproject.toml versions must match." >&2
+            echo "tag=$RELEASE_VERSION package=$package_version lock=$lock_version pyproject=$python_version" >&2
+            exit 1
+          fi
+
+          mapfile -t assets < <(gh release view "$RELEASE_TAG" --json assets --jq '.assets[].name' | sort)
+          required_assets=(
+            agentswarm-darwin-arm64
+            agentswarm-darwin-x64
+            agentswarm-linux-x64
+            agentswarm-windows-x64.exe
+          )
+
+          for required in "${required_assets[@]}"; do
+            if ! printf '%s\n' "${assets[@]}" | grep -Fxq "$required"; then
+              echo "Release $RELEASE_TAG is missing required asset: $required" >&2
+              exit 1
+            fi
+          done
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Publish npm package
+        run: npm publish --access public

.github/workflows/publish-npm-on-release.yml

@@ -1,4 +1,4 @@
-name: Publish npm on Release
+name: Fallback Publish npm on Release
 
 on:
   release:
@@ -34,6 +34,11 @@ jobs:
         run: |
           set -euo pipefail
 
+          if [[ -z "${NODE_AUTH_TOKEN}" ]]; then
+            echo "NPM_TOKEN is required to publish to npm." >&2
+            exit 1
+          fi
+
           release_version="${RELEASE_TAG#v}"
           package_version="$(node -p "require('./package.json').version")"
           lock_version="$(node -p "require('./package-lock.json').packages[''].version")"

RELEASE.md

@@ -1,6 +1,6 @@
 # Release Workflow
 
-OpenSwarm releases are GitHub Release driven. The release tag, npm package version, lockfile version, and Python project metadata must use the same version.
+OpenSwarm releases use one normal path: `Build TUI Binaries` builds the required assets, publishes the GitHub Release, then publishes `@vrsen/openswarm` to npm in the same workflow run. The release tag, npm package version, lockfile version, and Python project metadata must use the same version.
 
 ## Release Inputs
 
@@ -19,12 +19,15 @@ OpenSwarm releases are GitHub Release driven. The release tag, npm package versi
 2. Merge the version bump to `main`.
 3. Run the `Build TUI Binaries` workflow from the `main` branch in GitHub Actions. Leave `version` blank to use `package.json`, or pass the exact version without the `v` prefix.
 4. Confirm the workflow creates `vX.Y.Z` with all required binary assets.
-5. Let `Publish npm on Release` publish `@vrsen/openswarm` from the release tag.
+5. Let the downstream npm publish job in the same workflow publish `@vrsen/openswarm` from the release tag.
 
-Pushing a matching `vX.Y.Z` tag also runs the binary release workflow, but the manual workflow is the preferred path because it builds assets and publishes the GitHub Release in one run.
+Pushing a matching `vX.Y.Z` tag also runs the binary release workflow. The manual workflow is the preferred path because it builds assets, publishes the GitHub Release, and publishes npm in one run.
+
+GitHub releases created with `${{ github.token }}` do not start separate `on: release` workflows. `Fallback Publish npm on Release` exists only for releases that are published manually, externally, or through an API token that can trigger release workflows. It is not the normal release path.
 
 ## Release Gates
 
 - The binary release workflow fails if the tag/input version does not match `package.json`, `package-lock.json`, and `pyproject.toml`.
-- The npm publish workflow fails if the GitHub Release is missing any required TUI binary asset.
+- The npm publish job fails if `NPM_TOKEN` is missing, versions do not match, or the GitHub Release is missing any required TUI binary asset.
+- The fallback npm publish workflow runs the same key checks for manually or externally published releases.
 - The npm package uses `publishConfig.access=public` so scoped publishes do not depend on CLI flags alone.