fix publish workflow: add build step, use OIDC trusted publishing, bump 0.0.196

publish was missing a build step so the npm tarball had no dist/.
switch from NPM_TOKEN to OIDC trusted publishing — explicitly unset
NODE_AUTH_TOKEN so setup-node's .npmrc doesn't override the OIDC flow.
bump version since v0.0.195 tag exists from the failed publish attempt.

Made-with: Cursor

.github/workflows/publish.yml

@@ -34,6 +34,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Build
+        run: pnpm build
+
       - name: Get package version
         id: version
         run: |
@@ -98,9 +101,7 @@ jobs:
 
       - name: Publish to npm
         if: steps.check_tag.outputs.exists == 'false'
-        run: npm publish --provenance --access public
+        run: NODE_AUTH_TOKEN="" npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Summary
         if: always()

.husky/pre-commit

@@ -1,8 +0,0 @@
-# sync action lockfile when action/package.json changes
-if git diff --cached --name-only | grep -q "^action/package.json$"; then
-    echo "🔒 syncing action/pnpm-lock.yaml..."
-    # note: pnpm -C action install will *not* treat "action" as a monorepo root if run from repo root;
-    # to install with action/ as the workspace root (and search upwards), cd into action first:
-    (cd action && pnpm install --no-frozen-lockfile)
-    git add action/pnpm-lock.yaml
-fi

commands/init.ts

@@ -384,7 +384,9 @@ async function ensureInstallation(ctx: {
       isOrg: initial.isOrg,
     });
     activeSpin!.stop(`pullfrog is installed on selected repos, but ${repoRef} is not included.`);
-    p.log.info(`add it under "Repository access" on the installation config page.\n  ${pc.dim(configUrl)}`);
+    p.log.info(
+      `add it under "Repository access" on the installation config page.\n  ${pc.dim(configUrl)}`
+    );
     const openIt = await p.confirm({ message: "open browser?", active: "yes", inactive: "no" });
     handleCancel(openIt);
     if (openIt) openBrowser(configUrl);
@@ -742,7 +744,9 @@ async function promptTestRun(ctx: { token: string; owner: string; repo: string }
 
   activeSpin!.stop("dispatched test run");
   if (result.data.url) {
-    process.stdout.write(`${pc.gray(p.S_BAR)}    ${link(pc.dim(result.data.url), result.data.url)}\n`);
+    process.stdout.write(
+      `${pc.gray(p.S_BAR)}    ${link(pc.dim(result.data.url), result.data.url)}\n`
+    );
     openBrowser(result.data.url);
   }
 }
@@ -867,7 +871,9 @@ async function main() {
     if (!merged) skipTestRun = true;
   } else {
     const short = result.data.hash?.slice(0, 7);
-    spin.stop(short ? `committed pullfrog.yml to repo ${pc.dim(short)}` : "committed pullfrog.yml to repo");
+    spin.stop(
+      short ? `committed pullfrog.yml to repo ${pc.dim(short)}` : "committed pullfrog.yml to repo"
+    );
   }
 
   if (!skipTestRun && !secrets.hasRuns) {

mcp/selectMode.ts

@@ -1,6 +1,6 @@
 import { type } from "arktype";
 import { formatMcpToolRef } from "../external.ts";
-import { PR_SUMMARY_FORMAT, type Mode } from "../modes.ts";
+import { type Mode, PR_SUMMARY_FORMAT } from "../modes.ts";
 import { apiFetch } from "../utils/apiFetch.ts";
 import { log } from "../utils/log.ts";
 import type { ToolContext } from "./server.ts";

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pullfrog",
-  "version": "0.0.195",
+  "version": "0.0.196",
   "type": "module",
   "bin": {
     "pullfrog": "dist/cli.mjs",
@@ -20,7 +20,7 @@
     "scratch": "node scratch.ts",
     "upDeps": "pnpm up --latest",
     "lock": "pnpm install --no-frozen-lockfile",
-    "prepare": "cd .. && husky action/.husky"
+    "prepare": "cd .. && husky"
   },
   "devDependencies": {
     "@actions/core": "^1.11.1",