ci: release skips versions already on npm; npm 11 check survives a published version

.github/workflows/ci.yml

@@ -93,12 +93,14 @@ jobs:
           '
       # npm 11 rewrites or drops package.json fields it considers invalid at
       # publish time (a ./ prefixed bin is removed), and npm 10 on this runner
-      # does not. Run the publish checks with npm 11 and fail on any correction.
-      - name: publish dry run with npm 11
+      # does not. `npm pkg fix` applies the same corrections; unlike
+      # `publish --dry-run` it does not fail once the version is on npm.
+      # Fail on any correction.
+      - name: package.json survives an npm 11 publish
         run: |
           set -euo pipefail
-          npx --yes npm@11.6.2 publish --dry-run --access public 2>&1 | tee publish-dry-run.log
-          if grep -q "auto-corrected" publish-dry-run.log; then
-            echo "npm would rewrite package.json on publish; fix the fields listed above" >&2
+          npx --yes npm@11.6.2 pkg fix
+          if ! git diff --exit-code package.json; then
+            echo "npm 11 would rewrite package.json on publish; apply the diff above" >&2
             exit 1
           fi

.github/workflows/release.yml

@@ -4,20 +4,45 @@ on:
   push:
     tags: ["v*"]
 
-# least privilege: read the repo, and mint the OIDC token npm provenance needs
 permissions:
   contents: read
-  id-token: write
 
 jobs:
-  publish:
+  check:
     runs-on: ubuntu-latest
+    outputs:
+      published: ${{ steps.npm.outputs.published }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       # fail before any install or build when the tag and the version disagree
       - name: tag matches package.json
         run: |
           test "v$(node -p "require('./package.json').version")" = "${GITHUB_REF_NAME}"
+      # a version already on npm (for example one published by hand) keeps its
+      # tag and release: the publish job is skipped rather than failing on it.
+      # A failed lookup counts as unpublished, so the publish runs and fails loudly.
+      - name: version already on npm
+        id: npm
+        run: |
+          name="$(node -p "require('./package.json').name")"
+          version="$(node -p "require('./package.json').version")"
+          if [ "$(npm view "${name}@${version}" version 2>/dev/null)" = "${version}" ]; then
+            echo "::notice::${name}@${version} is already on npm, skipping publish"
+            echo "published=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  publish:
+    needs: check
+    if: needs.check.outputs.published != 'true'
+    runs-on: ubuntu-latest
+    # least privilege: read the repo, and mint the OIDC token npm provenance needs
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 All notable changes to this project are recorded here. The format follows Keep a Changelog.
 
-## 0.1.0 (unreleased)
+## 0.1.0 (2026-10-09)
 
 First public release of `@co-messi/supercut`.
 
@@ -28,7 +28,7 @@ First public release of `@co-messi/supercut`.
 
 ### Fixed
 
-- The `supercut` command survives `npm publish` on npm 11, which drops a `bin` path written with a leading `./`. CI now runs an npm 11 publish dry run and fails if npm would rewrite `package.json`.
+- The `supercut` command survives `npm publish` on npm 11, which drops a `bin` path written with a leading `./`. CI checks `package.json` with npm 11 and fails if npm would rewrite it on publish.
 - `supercut record` exits nonzero when any scene failed (the take is still written), names each failed scene with its reason, and points at the likely cause: the app URL and port for an error page or a refused connection, the selector for a control that never became visible. An app that is not listening gives a short message instead of a Playwright call log.
 - `supercut doctor` no longer passes when the Chromium binary is missing from disk. The unused ffprobe check is removed.
 - The Chromium install command in `doctor` and `render` errors runs supercut's own copy of Playwright (`node "<its path>/cli.js" install chromium`). `npx playwright install chromium`, even with a version pinned, run inside an app with its own `@playwright/test` ran that app's Playwright and installed its browser revision, which supercut cannot find.