ci(release): publish on release published, and verify tag matches version

.github/workflows/npm-publish-github-packages.yml

@@ -1,11 +1,15 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+# Publishes to GitHub Packages when a release is published.
+# See .claude/skills/release/SKILL.md for the release procedure.
 
 name: Node.js Package
 
 on:
   release:
-    types: [created]
+    # published, not created: GitHub fires `created` when a *draft* is saved, which
+    # would publish from the default branch before the tag exists — and then fires
+    # `published` (not `created`) when that draft is released, so the real release
+    # would ship nothing.
+    types: [published]
 
 env:
   NODE_VERSION: 24
@@ -21,6 +25,8 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run build
       - run: pnpm test
 
   publish-gpr:
@@ -38,9 +44,23 @@ jobs:
           cache: pnpm
           registry-url: https://npm.pkg.github.com/
       - run: pnpm install --frozen-lockfile
+
+      # The release tag and package.json must agree, or the published version silently
+      # differs from the tag people will go looking for. TAG comes through env rather
+      # than being interpolated into the script.
+      - name: Verify tag matches package.json version
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+        run: |
+          VERSION="v$(node -p 'require("./package.json").version')"
+          if [ "$VERSION" != "$TAG" ]; then
+            echo "Release tag $TAG does not match package.json $VERSION" >&2
+            exit 1
+          fi
+
       # npm publish, not pnpm publish: pnpm adds git-state checks the release flow
       # does not need. prepublishOnly runs the build either way.
       # No --provenance: GitHub Packages does not accept provenance attestations.
       - run: npm publish
         env:
-          NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -63,5 +63,8 @@
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.67.0"
   },
-  "packageManager": "pnpm@10.13.1"
+  "packageManager": "pnpm@10.13.1",
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com/"
+  }
 }