feat: dev releases on merge to main, stable releases from GitHub Releases

[carlos-alm]

Summary

Consolidates dev and stable publishing into a single publish.yml workflow (required by npm Trusted Publishing's one-workflow-per-package constraint).

• push to main (PR merges) → publishes prerelease versions like 2.0.1-dev.abc1234 with --tag dev
• GitHub Release event → publishes stable versions with --tag latest

Key design choices

• Single workflow file — npm OIDC Trusted Publishing restricts each package to one configured workflow provider
• compute-version job — computes version + npm tag, shared via outputs to the publish job
• Concurrency group with cancel-in-progress: true — rapid merges only publish the latest main commit
• Skip logic — commits starting with chore: release v skip dev publish (avoids publishing the stable version bump as a dev release)
• No git side-effects for dev — no commits, tags, CHANGELOG, or PRs for dev releases
• Stable-only steps — version bump PR and tag push gated behind if: github.event_name == 'release'
• Unified version setting — both paths use npm version --no-git-tag-version + sync-native-versions.js

npm dist-tags after this

Command	Gets
npm install @optave/codegraph	Stable (latest)
npm install @optave/codegraph@dev	Latest dev from main
npm install @optave/codegraph@2.0.1-dev.abc1234	Specific dev build

Test plan

• Merge a PR to main — verify publish triggers and publishes 2.0.1-dev.{sha} with --tag dev
• Run npm view @optave/codegraph dist-tags — should show both latest and dev
• Create a GitHub Release — verify stable publish with --tag latest
• Verify stable release version bump PR is created correctly
• Merge a chore: release v* commit — verify dev publish is skipped

[greptile-apps]

Greptile Summary

This PR intends to add dev releases on every merge to main and simplify stable releases to GitHub Release triggers only, but dev-publish.yml is completely empty and contains no workflow code.

Changes made:

• Removed workflow_dispatch trigger and all input parameters from publish.yml (now release-event-only)
• Added explicit --tag latest to all npm publish commands in stable workflow
• Added step to disable prepublishOnly script in CI (though step ordering is incorrect)
• Created empty dev-publish.yml file

Critical issues:

• The main feature (dev publish workflow) is not implemented — dev-publish.yml is a 0-byte empty file
• prepublishOnly is disabled AFTER platform packages are published, which means it could still run and fail during platform package publishes
• CLAUDE.md documentation (lines 90-96) still describes workflow_dispatch as the release trigger, but this trigger has been removed

Confidence Score: 0/5

• DO NOT MERGE — the primary feature is completely missing
• The dev publish workflow file is entirely empty with 0 bytes, meaning the main feature described in the PR (dev releases on merge to main) is not implemented at all. Additionally, the prepublishOnly disable step occurs after platform packages are published, creating a potential failure scenario.
• dev-publish.yml requires complete implementation, and publish.yml needs step reordering

Important Files Changed

Filename	Overview
.github/workflows/dev-publish.yml	File is completely empty — entire dev publish workflow is missing
.github/workflows/publish.yml	Removed workflow_dispatch trigger and simplified to release-only; added --tag latest; prepublishOnly disabled in wrong order

_{Last reviewed commit: e8ac4fa}

[greptile-apps]

_{2 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

disabling prepublishOnly happens after platform packages are published — if prepublishOnly runs during platform package publish and fails, this step never executes

move this before "Publish platform packages" step

[greptile-apps]

Additional Comments (1)

.github/workflows/dev-publish.yml
dev-publish.yml is completely empty — the workflow content described in the PR is missing entirely