ci: auto-publish on release by calling publish.yml as a reusable workflow

release.yml created the GitHub Release with GITHUB_TOKEN, whose events don't
trigger other workflows — so publish.yml's 'release: published' trigger never
fired and npm was never published. Make release.yml call publish.yml directly
(workflow_call + secrets: inherit) after cutting the tag/release, gated on a
version change. A direct reusable-workflow call isn't subject to the
GITHUB_TOKEN recursion guard, so a version bump on main now auto-publishes —
no manual dispatch, no PAT secret. publish.yml keeps its release/dispatch
triggers for manual runs.

Author: kurtstohrer

.github/workflows/publish.yml

@@ -3,6 +3,15 @@ name: Publish to npm
 on:
   release:
     types: [published]
+  # Called directly by release.yml after it cuts the tag/release. A reusable
+  # workflow_call is a direct invocation, so it runs even though the release
+  # was created with GITHUB_TOKEN (whose events don't trigger other workflows).
+  workflow_call:
+    inputs:
+      dry-run:
+        description: 'Dry run (skip actual publish)'
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       dry-run:

.github/workflows/release.yml

@@ -9,6 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+    outputs:
+      changed: ${{ steps.version.outputs.changed }}
+      version: ${{ steps.version.outputs.version }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -41,3 +44,13 @@ jobs:
           gh release create "$TAG" \
             --title "$TAG" \
             --generate-notes
+
+  # Publish straight after the release is cut. Called as a reusable workflow
+  # (not via the `release: published` event, which GITHUB_TOKEN-created releases
+  # never fire) so a version bump on main now auto-publishes to npm with no
+  # manual dispatch and no PAT. Skipped when the version didn't change.
+  publish:
+    needs: release
+    if: needs.release.outputs.changed == 'true'
+    uses: ./.github/workflows/publish.yml
+    secrets: inherit