npm Trusted Publishers only supports ONE (repo, workflow, environment)
tuple per package, so the two split workflows cannot both be granted
OIDC publish rights. Consolidate into release.yml with a mode input:
- mode=stable -> publish-stable job, environment=production (reviewer
gate), contents:write (push lightweight tag).
- mode=channel -> publish-channel job, no environment, contents:read.
Concurrency group keys on mode + channel so stable serializes globally
and channels serialize per dist-tag. Trusted Publisher entry should
now point at release.yml with environment left blank (matches both
the production-gated stable job and the env-less channel job).
Replace tools/release.mjs with two workflow_dispatch flows:
- stable: production environment gate (Required Reviewers) + lightweight git tag. Trusted Publishing (OIDC) removes the need for an npm token.
- channel beta: disposable 0.0.0-beta-<sha>-<date> versions on the corresponding dist-tag, no tag, no commit. Any collaborator can dispatch without npm credentials.
Pack-time scans via publint, attw, gitleaks; weekly Dependabot for npm + actions.
clh02467605