refactor: use workflow_run instead of workflow_call

- publish.yml now triggers automatically after ci.yml completes
- Removed publish job from ci.yml (no longer needed)
- Only publishes if CI workflow succeeded
- Cleaner pattern: workflows are decoupled and run independently
- publish.yml triggers on both tag pushes and ci completion

Author: sreya

.github/workflows/ci.yml

@@ -113,14 +113,3 @@ jobs:
 
       - name: Build library
         run: bun run build
-
-  # Call publish workflow after all checks pass on main
-  publish:
-    name: publish to npm
-    # Only publish on main branch pushes after all checks pass
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    needs: [fmt, lint, typecheck, test, build]
-    uses: ./.github/workflows/publish.yml
-    permissions:
-      contents: read
-      id-token: write # Required for OIDC trusted publishing

.github/workflows/publish.yml

@@ -4,8 +4,12 @@ on:
   push:
     tags:
       - 'v*'
-  workflow_call:
-    # Allow calling from other workflows (e.g., ci.yml)
+  workflow_run:
+    workflows: ["ci"]
+    types:
+      - completed
+    branches:
+      - main
 
 permissions:
   contents: read
@@ -15,6 +19,8 @@ jobs:
   publish:
     name: publish to npm
     runs-on: ubuntu-latest
+    # Only run if CI workflow succeeded (for workflow_run trigger)
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'push' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4