ci(publish): NPM_TOKEN fallback, prerelease --tag beta, workflow_dispatch

- Same contract as mcp-client publish workflow

Made-with: Cursor

Author: ilyar

.github/workflows/publish.yml

@@ -1,12 +1,17 @@
 name: Publish @spawn-dock/dev-tunnel
 
 on:
+  workflow_dispatch:
   push:
     tags:
       - "v*"
     branches:
       - main
 
+concurrency:
+  group: publish-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
@@ -25,7 +30,17 @@ jobs:
           node-version: 22.12.0
           registry-url: https://registry.npmjs.org
 
+      - name: Verify npm auth secret
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NPM_KEY }}
+        run: |
+          if [[ -z "${NODE_AUTH_TOKEN}" ]]; then
+            echo "Missing npm auth. Set repository secret NPM_TOKEN (or NPM_KEY)." >&2
+            exit 1
+          fi
+
       - run: npm ci
+
       - name: Determine version type
         id: version
         run: |
@@ -48,14 +63,20 @@ jobs:
 
       - run: npm run build
 
-      - name: Publish release
+      - name: Publish release (stable or prerelease)
         if: steps.version.outputs.type == 'release'
-        run: npm publish
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_KEY }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NPM_KEY }}
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if [[ "$VERSION" == *-* ]]; then
+            npm publish --access public --tag beta
+          else
+            npm publish --access public
+          fi
 
       - name: Publish canary
         if: steps.version.outputs.type == 'canary'
-        run: npm publish --tag canary
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_KEY }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN || secrets.NPM_KEY }}
+        run: npm publish --access public --tag canary