ci: split release into nightly + tag-driven (rc/latest), drop NPM_TOKEN

[walkindude]

Summary

Three release channels in one workflow:

Trigger	npm version	dist-tag	GH Release
push to master	<pkg.version>-nightly.<YYYYMMDD>.<sha7>	nightly	—
tag v<X>-rc.<N>	<X>-rc.<N>	rc	prerelease
tag v<X>-<id>.<N>	<X>-<id>.<N>	<id>	prerelease
tag v<X>	<X>	latest	stable

Tag-derivation is generic: any semver prerelease identifier becomes the dist-tag (v0.2.0-beta.0 → beta), so no special-casing per channel.

Notable

• Nightly version stamping is ephemeral. The job mutates package.json + .claude-plugin/plugin.json in-place (never committed), then runs pnpm run check:versions to confirm parity before pnpm run build and npm publish. The base version comes straight from package.json on master, so master always advertises the next-target version.
• Concurrency group nightly-publish with cancel-in-progress: false serializes master pushes — two close commits don't race the publish step. We want every commit's nightly to ship.
• OIDC + Trusted Publishing. NPM_TOKEN is gone from both jobs. id-token: write is the only credential; npm verifies the workflow's identity. After the first successful OIDC publish from this branch, the NPM_TOKEN secret can be revoked in repo settings.
• Provenance kept on every publish (--provenance) — works hand-in-hand with OIDC and produces signed attestations for every nightly + rc + latest.
• Bundle stamping caveat (deferred). scripts/bundle.js derives its runtime version stamp from git (tag → tag, otherwise → dev-<sha>), independent of package.json. Nightly bins will report dev-<sha> at runtime even though npm version is <base>-nightly.<date>.<sha>. Both encode the sha, so reproducibility is intact. We can teach bundle.js to prefer a mutated package.json version in a follow-up if the inconsistency bites.

Test plan

Cannot fully verify without merging — Trusted Publishing OIDC + tag-triggered jobs only run from master. Plan once merged:

• Merge → first nightly publishes automatically. Verify npm view cli-bridge versions lists 0.1.2-nightly.<date>.<sha> and npm view cli-bridge dist-tags shows nightly: 0.1.2-nightly.<date>.<sha>. latest stays at 0.1.2.
• Eyeball the workflow run's ::notice:: line to confirm derived version + dist-tag.
• Once feat(server): consolidate per-spec triggers into MCP instructions #16 (trigger-dedup) merges on top of this, push v0.1.3 to confirm latest path. (Or push v0.1.3-rc.0 first to prove the rc path; up to you.)
• Revoke NPM_TOKEN secret after first OIDC publish succeeds.

Existing local validation:

• Pre-commit hook ran format, typecheck, lint, test, build, check:versions — all green.
• Tag-derivation bash logic mentally traced against v0.1.3, v0.1.3-rc.0, v0.1.3-dev.5, v0.2.0-beta.

🤖 Generated with Claude Code