ci(sdk): drop the move-tag mode — Trusted Publishing cannot move a dist-tag

[nandal]

Problem

The move-tag mode added in #37 does not work. It was shipped explicitly labelled unproven, and the test settled it:

npm error code E401
npm error 401 Unauthorized - PUT /-/package/@bytesbrains%2fmaktub-sdk/dist-tags/latest

(run 30399767653) Trusted Publishing authorises npm publish and nothing else. A standalone npm dist-tag add is a separate registry write the OIDC exchange doesn't cover, so it can only be done locally by a maintainer with 2FA — which is how latest was ultimately moved to 0.1.0-dev.4.

Leaving a mode that always fails is worse than not having one. #37 said it should be deleted rather than left as a trap if this happened, so here it is.

Change summary

• Removed the mode and move_tag_version inputs, the three move-tag steps, and the inputs.mode == 'publish' conditions threaded through the publish path. The workflow is back to one job with one purpose: 13 steps, 2 inputs.
• The header now records why there's no such mode, with the error signature, so it doesn't get re-attempted by someone reasoning that CI "should" be able to do this.

Worth being clear that the mode was never needed for the steady state. npm publish sets the dist-tag as part of publishing, so latest moves forward on its own with every release. The only reason it came up was a one-off cleanup: latest was stuck on 0.1.0-dev.2 because the old pre-release guard had refused to point it anywhere newer. That guard is gone (#37) and the tag is corrected, so the situation can't recur.

Tests

YAML validated; step routing re-checked — all publish steps are unconditional again except the two dry_run branches, and no mode/retag references remain.

Verified on the registry that the end state this mode was meant to reach is already reached:

latest: 0.1.0-dev.4
dev:    0.1.0-dev.4

Publish behaviour is untouched, so the last green publish (run 30398802432) remains the evidence for that path.

Risk

Very low. Removes a code path that could only ever fail. The remaining path is the one already proven by a successful publish.

Backwards-compat

No consumer impact. Anyone who dispatched with mode will find the input gone — it never worked, so nothing depended on it.

Privacy copy

No user-facing privacy copy.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[wrokin]

🤖 wrokin code review

No issues found. This is a clean removal of the move-tag mode from the SDK publish workflow.

The diff correctly:

• Removes the mode and move_tag_version inputs (no longer needed)
• Drops the if: inputs.mode == 'publish' guards since publish is now the only path
• Deletes all six move-tag steps (including the steps.retag block)
• Updates the Summary to reference only steps.meta.outputs.* without the fallback to steps.retag

steps.meta (the version-exists check step, id: meta) previously only ran in publish mode (it was guarded), which is why steps.retag existed as a parallel extraction path. Now steps.meta runs unconditionally and is the sole source of name/version. Consistent and correct.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}

[wrokin]

🛡️ wrokin security hunter

No vulnerabilities were proven in this pull request — the hunter found nothing it could exploit and prove by execution.

Advisory only — this check never blocks your PR.

[wrokin]

🤖 wrokin security audit

No security-relevant findings in this diff. The changes remove a non-functional move-tag mode, simplify the workflow, and do not introduce any new injection points, exposed secrets, authorization weaknesses, or unsafe handling of untrusted data.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}