From cbae97a3051577017895b8bf1485d9f7775cb996 Mon Sep 17 00:00:00 2001
From: Paddy Mullen <paddy@paddymullen.com>
Date: Fri, 26 Jun 2026 12:13:34 -0400
Subject: [PATCH] ci: remove standalone release-npm.yml workflow

The release-npm job in release.yml already handles npm publishing as
part of every normal release. The standalone workflow was an emergency
fallback that is no longer needed now that the job lives in release.yml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/release-npm.yml | 114 ------------------------------
 1 file changed, 114 deletions(-)
 delete mode 100644 .github/workflows/release-npm.yml

diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
deleted file mode 100644
index cd1d55044..000000000
--- a/.github/workflows/release-npm.yml
+++ /dev/null
@@ -1,114 +0,0 @@
-name: Release npm
-
-# Emergency standalone workflow for re-publishing buckaroo-js-core to npm.
-# The normal path is the release-npm job in release.yml, which runs
-# automatically after the PyPI release and inherits the version from it.
-# Use this workflow only when you need to re-publish a specific version
-# without triggering a full PyPI release (e.g. after a Trusted Publisher
-# config fix or a transient npm outage).
-#
-# Auth: npm Trusted Publishing via OIDC (no NPM_TOKEN secret). Register
-# this repo + workflow as a Trusted Publisher in the npm UI:
-#   https://www.npmjs.com/package/buckaroo-js-core/access
-# Repository:  buckaroo-data/buckaroo
-# Workflow:    release-npm.yml
-# Environment: npm
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to publish as (must match the buckaroo Python release, e.g. 0.13.0)"
-        required: true
-        type: string
-      dry_run:
-        description: "Run npm publish with --dry-run (no actual publish)"
-        required: false
-        type: boolean
-        default: false
-
-permissions:
-  contents: read
-  id-token: write
-
-jobs:
-  release-npm:
-    name: Publish buckaroo-js-core to npm
-    # GitHub-hosted runner required: npm Trusted Publishing OIDC is only
-    # supported on github-hosted runners (Depot's depot-ubuntu-latest is
-    # treated as self-hosted and won't receive npm OIDC credentials).
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    environment: npm
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6
-        with:
-          version: 9.10.0
-
-      - name: Setup Node.js with npm registry
-        uses: actions/setup-node@v6
-        with:
-          registry-url: 'https://registry.npmjs.org'
-          cache: 'pnpm'
-          cache-dependency-path: 'packages/pnpm-lock.yaml'
-
-      - name: Install pnpm dependencies
-        working-directory: packages
-        run: pnpm install --frozen-lockfile
-
-      - name: Upgrade npm to a Trusted-Publishing-capable version
-        # Trusted Publishing requires npm >= 11.5.1. The global npm dir
-        # on github-hosted runners is root-owned, so sudo is needed.
-        run: sudo npm install -g npm@11.5.1
-
-      - name: OIDC diagnostics (compare against npm Trusted Publisher config)
-        # Prints the values npm checks against the Trusted Publisher
-        # config on the package. Compare these to what's registered at
-        # https://www.npmjs.com/package/buckaroo-js-core/access
-        run: |
-          echo "npm version:              $(npm --version)"
-          echo "GITHUB_REPOSITORY:        ${GITHUB_REPOSITORY}"
-          echo "GITHUB_WORKFLOW_REF:      ${GITHUB_WORKFLOW_REF}"
-          echo "GITHUB_REF:               ${GITHUB_REF}"
-          echo "GITHUB_REF_NAME:          ${GITHUB_REF_NAME}"
-          echo "GITHUB_JOB:               ${GITHUB_JOB}"
-          echo "Job environment (yaml):   npm"
-          echo
-          echo "On npmjs.com the Trusted Publisher must match:"
-          echo "  Owner:        $(echo "${GITHUB_REPOSITORY}" | cut -d/ -f1)"
-          echo "  Repository:   $(echo "${GITHUB_REPOSITORY}" | cut -d/ -f2)"
-          echo "  Workflow:     $(basename "${GITHUB_WORKFLOW_REF%@*}")"
-          echo "  Environment:  npm  (or leave blank if no environment configured)"
-
-      - name: Set buckaroo-js-core version to ${{ inputs.version }}
-        working-directory: packages/buckaroo-js-core
-        run: npm version "${{ inputs.version }}" --no-git-tag-version --allow-same-version
-
-      - name: Build buckaroo-js-core
-        working-directory: packages/buckaroo-js-core
-        run: pnpm run build
-
-      - name: Check if version already published
-        id: check
-        run: |
-          VERSION="${{ inputs.version }}"
-          if npm view "buckaroo-js-core@${VERSION}" version >/dev/null 2>&1; then
-            echo "buckaroo-js-core@${VERSION} already on npm — skipping publish."
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "skip=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Publish to npm (Trusted Publishing + provenance)
-        if: steps.check.outputs.skip != 'true'
-        working-directory: packages/buckaroo-js-core
-        run: |
-          if [ "${{ inputs.dry_run }}" = "true" ]; then
-            npm publish --access public --provenance --dry-run --loglevel=verbose
-          else
-            npm publish --access public --provenance --loglevel=verbose
-          fi