Dual-publish to GitHub Packages alongside npmjs.org

.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish Package to npm
+name: Publish Package
 
 on:
   release:
@@ -10,8 +10,17 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      # Lets the runner mint the OIDC token npm exchanges for publish rights.
+      # Lets the runner mint the OIDC token npm exchanges for publish rights (npmjs.org).
       id-token: write
+      # Dual-published to GitHub Packages too, auth'd with the workflow's own
+      # GITHUB_TOKEN (no OIDC trusted-publishing equivalent there). This keeps
+      # the whole @silverassist scope resolvable from a single registry for
+      # consumers whose .npmrc points @silverassist at GitHub Packages --
+      # needed because @silverassist/nextjs-core is GitHub-Packages-only
+      # (private); mixing registries within one scope otherwise makes npm
+      # treat every OTHER package's lockfile-resolved URL as an untrusted
+      # "remote" dependency (npm's allow-remote hardening).
+      packages: write
     steps:
       - uses: actions/checkout@v7
 
@@ -32,7 +41,7 @@ jobs:
       # Skips instead of failing when the version is already on the
       # registry -- keeps a re-run (or a release cut after a manual
       # publish) idempotent rather than erroring on a duplicate version.
-      - name: Check if this version is already published
+      - name: Check if this version is already published (npmjs.org)
         id: version-check
         run: |
           PACKAGE_NAME=$(node -p "require('./package.json').name")
@@ -48,14 +57,44 @@ jobs:
       - if: steps.version-check.outputs.already-published == 'false'
         run: npm publish --access public
 
+      # Re-running setup-node with a different registry-url rewrites .npmrc's
+      # @silverassist scope mapping (and its auth line) to point at GitHub
+      # Packages instead -- the officially supported way to publish the same
+      # job to a second registry. Doesn't disturb the npmjs.org publish above,
+      # which already ran.
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+          registry-url: 'https://npm.pkg.github.com'
+          scope: '@silverassist'
+
+      - name: Check if this version is already published (GitHub Packages)
+        id: ghp-version-check
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PACKAGE_NAME=$(node -p "require('./package.json').name")
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          if npm view "$PACKAGE_NAME@$PACKAGE_VERSION" version >/dev/null 2>&1; then
+            echo "already-published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "already-published=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish to GitHub Packages
+        if: steps.ghp-version-check.outputs.already-published == 'false'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm publish
+
       - name: Create summary
         if: success()
         run: |
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
           if [ "${{ steps.version-check.outputs.already-published }}" = "true" ]; then
-            echo "## ⏭️ Version \`$PACKAGE_VERSION\` already published — skipped" >> $GITHUB_STEP_SUMMARY
+            echo "## ⏭️ Version \`$PACKAGE_VERSION\` already published to npmjs.org — skipped" >> $GITHUB_STEP_SUMMARY
           else
-            echo "## 📦 Package Published Successfully!" >> $GITHUB_STEP_SUMMARY
+            echo "## 📦 Published to npmjs.org" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "**Version:** \`$PACKAGE_VERSION\`" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY
@@ -68,3 +107,9 @@ jobs:
             echo "npm install @silverassist/icons@$PACKAGE_VERSION" >> $GITHUB_STEP_SUMMARY
             echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
           fi
+          if [ "${{ steps.ghp-version-check.outputs.already-published }}" = "true" ]; then
+            echo "## ⏭️ Version \`$PACKAGE_VERSION\` already published to GitHub Packages — skipped" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "## 📦 Published to GitHub Packages" >> $GITHUB_STEP_SUMMARY
+            echo "- [View on GitHub Packages](https://github.com/SilverAssist/icons/pkgs/npm/icons)" >> $GITHUB_STEP_SUMMARY
+          fi