feat(release): the forge publish leg moves to CI on the tag push; the laptop verifies by readback and keeps the abort-before-storefront guard

.forgejo/workflows/publish-forge.yml

@@ -0,0 +1,67 @@
+name: Publish (forge)
+
+# Datacenter-side forge publish, moved off the laptop: an 87MB tarball PUT
+# over the laptop's WAN times out; the forge's own runner does it in seconds.
+# scripts/release.sh tags + pushes, then polls this workflow's result (npm
+# view against the forge registry) before it ever touches the npmjs leg —
+# see the "delegation contract" in scripts/release.sh's forge-publish step.
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    name: Publish to the forge registry
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      - name: Publish + readback-verify on the forge registry
+        env:
+          FORGE_NPM_TOKEN: ${{ secrets.FORGE_NPM_TOKEN }}
+        run: |
+          set -eo pipefail
+
+          FORGE_NPM_REG="https://source.soulcraft.com/api/packages/soulcraft/npm/"
+          VERSION="$(node -p "require('./package.json').version")"
+          echo "Publishing @soulcraft/brainy@${VERSION} to the forge registry..."
+
+          TMPRC="$(mktemp)"
+          chmod 600 "$TMPRC"
+          {
+            echo "@soulcraft:registry=${FORGE_NPM_REG}"
+            echo "//source.soulcraft.com/api/packages/soulcraft/npm/:_authToken=${FORGE_NPM_TOKEN}"
+          } > "$TMPRC"
+
+          # The release script bumps package.json's version before it tags, so
+          # this tag's checkout already carries the version being published —
+          # nothing here re-derives it from the tag name.
+          PUBLISH_OK=true
+          if ! npm publish --tag latest --userconfig "$TMPRC"; then
+            PUBLISH_OK=false
+          fi
+
+          # Readback verify is the source of truth, run regardless of the publish
+          # exit code: a benign duplicate publish (a prior run, or a mirror, already
+          # landed this exact version) reports failure even though the registry
+          # already holds the right content.
+          LANDED_VERSION="$(npm view "@soulcraft/brainy@${VERSION}" version --userconfig "$TMPRC" 2>/dev/null || echo "")"
+          rm -f "$TMPRC"
+
+          if [ "$LANDED_VERSION" != "$VERSION" ]; then
+            echo "::error::Readback verify FAILED — the forge registry reports version '${LANDED_VERSION:-<none>}', expected '${VERSION}'. This is a genuine publish failure, not a benign duplicate."
+            exit 1
+          fi
+
+          if [ "$PUBLISH_OK" = true ]; then
+            echo "Published and verified @soulcraft/brainy@${VERSION} on the forge registry."
+          else
+            echo "::warning::npm publish reported failure, but readback confirms @soulcraft/brainy@${VERSION} is already live on the forge (a prior run or mirror landed it) — treating this run as successful, since the registry content is correct. Any OTHER failure mode would have failed the readback check above instead."
+          fi