ci: automate npm publishing of the portable skill

[ryanbaumann]

Pull Request

Summary

Adds automated CI/CD publishing for the portable skill (infographic-agent on npm) so releases are "automagic": bump the version in skill/infographic-agent/package.json, merge to main, and CI publishes it — no manual npm publish from a laptop.

Changes

• .github/workflows/publish-skill.yml — triggers on pushes to main that touch skill/infographic-agent/** (plus manual workflow_dispatch). It:
  • sanity-checks the package (node --check, py_compile, npm pack --dry-run),
  • reads the version from package.json and checks npm,
  • publishes only if that version is not already on npm (idempotent — doc/script edits without a version bump are safe no-ops),
  • runs npm publish --provenance --access public (supply-chain attestation via GitHub OIDC), and
  • pushes a skill-v<version> git tag.
• docs/releasing.md — documents the release flow and the one-time NPM_TOKEN secret setup.

Action required before this can publish

• Add a repository secret NPM_TOKEN (npm Automation/granular token with publish rights for infographic-agent). Steps are in docs/releasing.md.

Ordering note

npm currently has infographic-agent@2.0.1; the new skill/infographic-agent/ package (v3.0.0) arrives via #3. This workflow is dormant until that package exists on main and only ever publishes a version that isn't already on npm, so merging it early cannot ship a stale build. Once #3 lands, either the next skill change triggers it or you run it once from the Actions tab.

How Tested

• Lint checks pass (npm run lint) — n/a: no app source touched.
• Unit tests pass (npm test) — n/a: no app source touched.
• Production build succeeds (npm run build) — n/a: no app source touched.
• Manual testing (describe): workflow YAML validated (parses; single publish job, 6 steps). Publish/version-check logic is guarded so it no-ops on unchanged versions; verified npm view infographic-agent versions returns only 2.0.1, so 3.0.0 will be treated as new.

Screenshots

No UI changes (CI + docs only).

🤖 Generated with Claude Code

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2844518643

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Queue all pending release runs

This release workflow publishes immutable npm versions, but this concurrency block leaves GitHub Actions at the default queue: single behavior; GitHub documents that a newly queued run cancels and replaces an existing pending run in the same group. If several skill/infographic-agent version-bump pushes land while one publish is still running, an earlier pending version can be canceled and never published or tagged. Add queue: max or another queueing strategy so every release run is processed.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Restrict manual publishes to main

The manual trigger is not guarded by branch, and GitHub's manual-run flow allows selecting a branch/ref to run the workflow on. In that scenario a maintainer can accidentally publish and tag a package version from an unmerged feature branch even though the push trigger is main-only, because the publish/tag steps do not re-check github.ref. Add a job or publish-step condition for refs/heads/main before exposing the npm token.

Useful? React with 👍 / 👎.