chore: workflow wiring fixes for npm releases --release v0.1.3

Author: Kuberwastaken

.github/workflows/npm-publish.yml

@@ -15,6 +15,18 @@ permissions:
   contents: read
   id-token: write
 
+# Belt-and-suspenders: release.yml dispatches us explicitly because
+# `workflow_run` is unreliable when the upstream `Release` run was itself
+# triggered by a GITHUB_TOKEN workflow_dispatch. If both paths happen to
+# fire for the same release, this static concurrency group serializes them
+# — the first one publishes, the second waits and then no-ops (or errors
+# benignly at `npm publish` because the version is already on the registry).
+# Releases are version-monotonic so blanket serialisation is safe; there
+# isn't a scenario where two concurrent publishes should both succeed.
+concurrency:
+  group: npm-publish
+  cancel-in-progress: false
+
 jobs:
   npm-publish:
     if: >-

.github/workflows/release.yml

@@ -15,6 +15,10 @@ concurrency:
 
 permissions:
   contents: write
+  # `actions: write` is needed for the final step that dispatches
+  # npm-publish.yml via `gh workflow run`. Without it, `gh workflow run`
+  # gets a 403 from the GitHub API.
+  actions: write
 
 env:
   CARGO_TERM_COLOR: always
@@ -364,3 +368,24 @@ jobs:
           prerelease: false
           body_path: release-notes.md
           files: release/*
+
+      # Explicit hand-off to npm-publish.yml.
+      #
+      # We can't rely solely on the `workflow_run` trigger in npm-publish.yml
+      # because this Release workflow is itself triggered by a workflow
+      # dispatch from auto-release.yml's GITHUB_TOKEN, and GitHub's
+      # automatic-token rules don't list `workflow_run` as an exception to
+      # the "events from GITHUB_TOKEN don't create new workflow runs" rule.
+      # In practice that means the workflow_run chain silently no-ops on
+      # auto-cut releases. Dispatching directly here makes the publish step
+      # deterministic — the workflow_run trigger stays as a manual-release
+      # fallback.
+      - name: Dispatch npm-publish.yml
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh workflow run npm-publish.yml \
+            --repo "${{ github.repository }}" \
+            --ref main \
+            -f version="${{ inputs.version }}"
+          echo "Dispatched npm-publish.yml for ${{ inputs.version }}."