From 08480d0963cb84ac395e582069dc512f9b772601 Mon Sep 17 00:00:00 2001
From: Sweets Sweetman <sweetmantech@gmail.com>
Date: Mon, 26 Oct 2026 13:39:09 -0500
Subject: [PATCH 1/2] ci: publish to npm via trusted publishing; commit the
 bump only after publish

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 34 ++++++++++++++++++++--------------
 package.json                  |  4 ++++
 2 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0db1c39..7cdcbb6 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      # npm trusted publishing: npm exchanges this OIDC token for a publish token.
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -28,22 +30,19 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           registry-url: https://registry.npmjs.org
 
+      # Trusted publishing needs npm >= 11.5.1.
+      - run: npm install -g npm@^11.5.1
+
       - run: pnpm install --frozen-lockfile
 
+      # Bump in the working tree only; it is committed after a successful publish
+      # so a failed run never leaves an unpublished version on main.
       - name: Bump patch version
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          # Re-base onto the latest main first so a re-run or a race never hits a
-          # non-fast-forward push (the old failure mode).
-          git pull --rebase origin main
-          VERSION=$(npm version patch --no-git-tag-version)
-          git add package.json
-          git commit -m "chore: bump version to ${VERSION} [skip ci]"
-          git push origin HEAD:main
+        id: bump
+        run: echo "version=$(npm version patch --no-git-tag-version)" >> "$GITHUB_OUTPUT"
 
       - run: pnpm exec tsc --noEmit
 
@@ -52,6 +51,13 @@ jobs:
       - run: pnpm test
 
       - name: Publish to npm
-        run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish
+
+      - name: Commit version bump
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add package.json
+          git commit -m "chore: bump version to ${{ steps.bump.outputs.version }} [skip ci]"
+          git pull --rebase origin main
+          git push origin HEAD:main
diff --git a/package.json b/package.json
index e812f7d..58fb609 100644
--- a/package.json
+++ b/package.json
@@ -2,6 +2,10 @@
   "name": "@recoupable/cli",
   "version": "0.1.18",
   "description": "Recoup platform CLI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/recoupable/cli.git"
+  },
   "type": "module",
   "bin": {
     "recoup": "./dist/bin.cjs"

From 5ae052fe351d9b13abae83b78a164ac62484ec61 Mon Sep 17 00:00:00 2001
From: Sweets Sweetman <sweetmantech@gmail.com>
Date: Mon, 26 Oct 2026 21:38:47 -0500
Subject: [PATCH 2/2] ci: bump from the higher of npm latest and package.json
 so reruns never republish

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7cdcbb6..beb0a47 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -39,10 +39,17 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       # Bump in the working tree only; it is committed after a successful publish
-      # so a failed run never leaves an unpublished version on main.
+      # so a failed run never leaves an unpublished version on main. Bumping from
+      # the higher of npm's latest and package.json keeps a rerun from re-publishing
+      # a version whose bump commit never reached main.
       - name: Bump patch version
         id: bump
-        run: echo "version=$(npm version patch --no-git-tag-version)" >> "$GITHUB_OUTPUT"
+        run: |
+          PUBLISHED=$(npm view @recoupable/cli version)
+          LOCAL=$(node -p "require('./package.json').version")
+          BASE=$(printf '%s\n%s\n' "$PUBLISHED" "$LOCAL" | sort -V | tail -1)
+          npm version "$BASE" --no-git-tag-version --allow-same-version
+          echo "version=$(npm version patch --no-git-tag-version)" >> "$GITHUB_OUTPUT"
 
       - run: pnpm exec tsc --noEmit