From 299a8f1728c0bbe41426e0aa5a5afe1f4141e8d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Arda=20Sevin=C3=A7?= <arda@ardasevinc.com>
Date: Fri, 17 Jul 2026 23:46:11 +0300
Subject: [PATCH] fix: dispatch trusted npm publication

---
 .github/workflows/publish.yml | 23 +++++++++++++++--------
 .github/workflows/release.yml |  6 +++++-
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d77a0c2..42e47ae 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,12 @@ name: Publish npm packages
 on:
   release:
     types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing GitHub release tag to publish
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -10,7 +16,7 @@ permissions:
   attestations: read
 
 concurrency:
-  group: npm-${{ github.event.release.tag_name }}
+  group: npm-${{ github.event.release.tag_name || inputs.tag }}
   cancel-in-progress: false
 
 jobs:
@@ -21,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ github.event.release.tag_name || inputs.tag }}
           persist-credentials: false
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
@@ -38,13 +44,14 @@ jobs:
         id: version
         shell: bash
         run: |
-          version="${{ github.event.release.tag_name }}"
+          release_tag="${{ github.event.release.tag_name || inputs.tag }}"
+          version="$release_tag"
           version="${version#v}"
-          test "${{ github.event.release.tag_name }}" = "v$version"
+          test "$release_tag" = "v$version"
           source_version="$(awk -F'"' '/^[[:space:]]*Version = / {print $2}' internal/buildinfo/buildinfo.go)"
           test "$version" = "$source_version"
           commit="$(git rev-parse HEAD)"
-          test "$commit" = "$(git rev-parse '${{ github.event.release.tag_name }}^{commit}')"
+          test "$commit" = "$(git rev-parse "$release_tag^{commit}")"
           printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
           printf 'commit=%s\n' "$commit" >> "$GITHUB_OUTPUT"
       - name: Download and verify native release assets
@@ -52,7 +59,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           mkdir dist
-          gh release download "${{ github.event.release.tag_name }}" --dir dist
+          gh release download "${{ github.event.release.tag_name || inputs.tag }}" --dir dist
           (cd dist && sha256sum --check checksums.txt)
           for artifact in dist/*; do
             gh attestation verify "$artifact" --repo "$GITHUB_REPOSITORY"
@@ -105,7 +112,7 @@ jobs:
             if npm view "$name@${{ steps.version.outputs.version }}" version >/dev/null 2>&1; then
               echo "already published identically: $name@${{ steps.version.outputs.version }}"
             else
-              npm publish "$tarball" --access public --provenance
+              npm publish "./$tarball" --access public --provenance
             fi
           done
       - name: Publish launcher package last
@@ -115,7 +122,7 @@ jobs:
           if npm view "mattermost-cli@${{ steps.version.outputs.version }}" version >/dev/null 2>&1; then
             echo "already published identically: mattermost-cli@${{ steps.version.outputs.version }}"
           else
-            npm publish "$tarball" --access public --provenance
+            npm publish "./$tarball" --access public --provenance
           fi
       - name: Verify exact registry artifacts
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2aa510c..aa90540 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
     tags: ["v*"]
 
 permissions:
-  actions: read
+  actions: write
   contents: write
   id-token: write
   attestations: write
@@ -120,3 +120,7 @@ jobs:
             -F draft=false \
             -F prerelease="${{ steps.version.outputs.prerelease }}" \
             -f make_latest="$latest" >/dev/null
+      - name: Dispatch npm publication
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh workflow run publish.yml --ref main -f tag="$GITHUB_REF_NAME"