Dispatch the GitHub Packages mirror from the release workflow

Author: laurentpellegrino

.github/workflows/github-packages.yaml

@@ -2,12 +2,12 @@ name: GitHub Packages
 
 # Mirrors published releases to GitHub Packages (npm.pkg.github.com) so the
 # package is listed on the organization packages page. The primary registry
-# remains npmjs.org; this publication is a courtesy mirror. Runs automatically
-# when a GitHub release is published and can be triggered manually for an
-# existing tag.
+# remains npmjs.org; this publication is a courtesy mirror. Dispatched by the
+# Release workflow after a successful release (a `release: published` trigger
+# would never fire, since releases are created with GITHUB_TOKEN and GitHub
+# suppresses workflow triggers from such events) and can be triggered manually
+# for an existing tag.
 on:
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
       tag:
@@ -27,7 +27,7 @@ jobs:
         # The raw value is passed through the environment (never interpolated
         # into the shell) and strictly validated before being used as a ref.
         env:
-          TAG_INPUT: ${{ inputs.tag || github.event.release.tag_name }}
+          TAG_INPUT: ${{ inputs.tag }}
         run: |
           set -euo pipefail
           if ! printf '%s' "$TAG_INPUT" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'; then

.github/workflows/release.yaml

@@ -19,6 +19,7 @@ on:
         type: string
 
 permissions:
+  actions: write # dispatch the GitHub Packages mirror workflow
   contents: write
   id-token: write # npm trusted publishing and provenance
 
@@ -138,3 +139,8 @@ jobs:
             --notes-file release-notes.md \
             $prerelease
           echo "Released $TAG: ${{ github.server_url }}/${{ github.repository }}/releases/tag/$TAG"
+
+      - name: Mirror to GitHub Packages
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run github-packages.yaml -f "tag=$TAG"