ci: auto-publish create-stark-rn on version bump (reusable publish workflow)

[tu11aa]

Summary

Wires automatic npm publish into the version-bump pipeline so scaffold-stark-rn behaves like scaffold-stark-2: a version bump and the create-stark-rn npm publish now happen in one flow. The standalone manual publish button is fully preserved as a fallback.

Before: version-bump.yml (push to main) bumped versions, committed chore(release): X, tagged, pushed — and stopped. npm-publish-cli.yml was workflow_dispatch-only; nothing triggered it automatically, so create-stark-rn only reached npm when a human clicked Run.

After: the bump job's computed version feeds a new publish job that calls the (now reusable) publish workflow automatically.

Approach

1. npm-publish-cli.yml → reusable workflow. Added a workflow_call: trigger mirroring the existing workflow_dispatch: inputs (version, dry_run) plus a new ref input. Switched from github.event.inputs.* to the unified inputs.* context (valid for both workflow_dispatch and workflow_call). dry_run is now normalized through a shell step to dodge GitHub's string-vs-boolean loose-equality pitfall ('true' == true is false in Actions expressions).
2. version-bump.yml → wire publish. The bump job now exposes new_version as an output. A new publish job (needs: bump) calls ./.github/workflows/npm-publish-cli.yml with secrets: inherit, passing version: <new_version>, ref: main, dry_run: false.

Timing-hazard trace (the important part)

The hazard: in a single workflow run, actions/checkout defaults to the SHA that triggered the run — the commit before the chore(release): bump. A naive publish job would rsync the template from the pre-bump packages/rn/ and publish stale source under the new version number.

How this PR avoids it — full trace (developer merges feat: … to main, SHA A):

Step	What happens
bump runs	if guard: A's msg is feat: … → not chore(release): → runs. Computes e.g. 1.0.5 → 1.1.0. Commits chore(release): 1.1.0 = SHA B, tags, git push origin main → origin/main tip = B. Job output new_version=1.1.0.
publish runs	needs: bump ⇒ starts only after bump pushed B. Calls reusable workflow with ref: main.
reusable checkout	ref: ${{ inputs.ref || github.ref_name }} → main → checks out origin/main = B (post-bump tree). packages/rn/ is the bumped source. ✅
version set	inputs.version = 1.1.0 → npm version 1.1.0. Published version == bumped version. ✅
publish	dry_run normalized to false → npm publish --access public with NPM_TOKEN (via secrets: inherit).
bump's own push re-triggers workflow	B's msg is chore(release): → bump skipped → needs: bump ⇒ publish skipped. No double publish, no loop. ✅

ref: main (not the vX tag) is a deliberate choice — see "Pre-existing issue noted" below.

Preserved behavior

• ✅ Loop guard intact (chore(release): push skips both bump and publish).
• ✅ dry_run end-to-end (and now type-safe across both triggers).
• ✅ NPM_TOKEN reaches the publish job via secrets: inherit.
• ✅ Manual "Publish create-stark-rn to npm" workflow_dispatch still works standalone: empty ref → triggering branch; empty version → root package.json (identical to prior behavior).
• ✅ Manual workflow_dispatch of version-bump now also bump+publishes (matches the requested scaffold-stark-2 behavior).

Verification

• actionlint on both workflows: clean, no findings (validates inputs context vs triggers, local reusable uses:, secrets: inherit).
• python3 -c "yaml.safe_load(...)" both files: parse OK.
• Static trigger/checkout/version trace above (CI-side dispatch testing is impossible pre-merge: gh workflow run / disable return 404 until the workflow exists on the default branch — known repo constraint).

⚠️ Activation note

version-bump.yml only fires on push to main. Per repo convention this PR targets develop, so it has no effect until develop is merged to main. The auto-publish path goes live on the first non-chore(release): push to main after that merge.

Pre-existing issue noted (not fixed here — out of scope)

version-bump.yml creates a lightweight tag (git tag "v$VERSION") but pushes with git push origin main --follow-tags, which only pushes annotated tags — so vX tags likely never reach origin today. This PR intentionally publishes from ref: main rather than ref: vX so it is not affected by this. Flagging for a separate fix if tag-on-origin is desired.

Files changed

• .github/workflows/npm-publish-cli.yml — +38 / -5 (reusable via workflow_call, unified inputs, normalized dry_run, explicit checkout ref).
• .github/workflows/version-bump.yml — +19 / -0 (bump job output + new publish job).