From 975f7ea6e0fae1900f39bb42ce4df7f8a3bd6608 Mon Sep 17 00:00:00 2001
From: Jake Fineman <help@wave.online>
Date: Sun, 26 Jul 2026 21:41:15 -0400
Subject: [PATCH] chore(ci): stop this fork from publishing over the real
 @wave-av/adk

This repo does not publish @wave-av/adk. npm serves 1.0.14, built from wave-av/sdks -> sdk-typescript/packages/adk. This repo is at 1.0.2 with a single-entry build and none of the six subpath exports consumers import.

The trigger was push: tags: [v*]. A version bump plus a tag here would have published a single-entry build over the real package -- a breaking release shipped by accident from a repo nobody realised was live.

Two changes, both reversible:
- trigger is now workflow_dispatch only, so it cannot fire on its own;
- a guard refuses any version not strictly ahead of the registry. Verified: 1.0.2 vs published 1.0.14 REFUSE, 1.0.14 vs 1.0.14 REFUSE, 0.9.0 REFUSE, 1.0.15 and 1.1.0 allow.

Also SHA-pins actions/checkout and actions/setup-node to the revisions lint.yml already uses; the mutable @v4 tags tripped the supply-chain scanner on a file that mints an npm token.

See wave-av/sdks#42.
---
 .github/workflows/publish.yml | 37 +++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 00213b8..8e0801e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,8 +1,23 @@
 name: Publish to npm
 
+# DISABLED TRIGGER — this repo does NOT publish @wave-av/adk.
+#
+# The package on npm is built from wave-av/sdks → sdk-typescript/packages/adk (currently 1.0.14).
+# This repo sits at 1.0.2 and is a stale fork: single-entry build, no ERROR-CODES.md, and none of the
+# six subpath exports (@wave-av/adk/tools, /agents, /adapters, /templates, /types) that the shipped
+# package builds and that consumers import.
+#
+# The trigger was `push: tags: ['v*']`. Left enabled, a version bump plus a tag here would publish a
+# single-entry build OVER a package whose consumers rely on those subpaths — a breaking release
+# shipped by accident, from a repo nobody realised was live.
+#
+# Now `workflow_dispatch` only, so it cannot fire on its own. If wave-av/sdks#42 concludes that THIS
+# repo should be the home, restore the tag trigger — but sync forward from 1.0.14 first, or the first
+# publish re-buries twelve versions of work.
+#
+# See wave-av/sdks#42.
 on:
-  push:
-    tags: ['v*']
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -11,9 +26,10 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      # SHA-pinned to match .github/workflows/lint.yml — a mutable tag can be silently repointed.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
@@ -22,6 +38,19 @@ jobs:
 
       - run: npm run build
 
+      # Belt and braces: even a deliberate manual dispatch must not clobber the real package. Refuse
+      # any version that is not strictly ahead of what npm already serves.
+      - name: Refuse to publish behind the registry
+        run: |
+          local_v=$(node -p "require('./package.json').version")
+          published_v=$(npm view @wave-av/adk version 2>/dev/null || echo "0.0.0")
+          echo "local=$local_v  published=$published_v"
+          newest=$(printf '%s\n%s\n' "$local_v" "$published_v" | sort -V | tail -1)
+          if [ "$local_v" = "$published_v" ] || [ "$newest" != "$local_v" ]; then
+            echo "::error::refusing to publish $local_v — npm already serves $published_v. This repo is a stale fork (see wave-av/sdks#42)."
+            exit 1
+          fi
+
       - run: npm publish --access public --no-provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}