ci: fix npm publish never firing after automated release tags

[dmchaledev]

Problem

npm publish has silently never run for any automated release. Verified against live state, not just the workflow YAML:

• npm view @hailbytes/security-headers versions shows only 1.0.1 (published 2025-05-19) — that's the only version ever published.
• The remote has tags v1.0.2 (→ 608b6f5) and v1.0.3 (→ b2143bb), both created by auto-tag.yml on 2026-06-16.
• publish.yml's entire run history is workflow_dispatch events; its last run was 2026-05-29, three weeks before v1.0.2/v1.0.3 were tagged. It has never once run off a tag push.

Root cause: auto-tag.yml pushes the release tag using the default secrets.GITHUB_TOKEN (.github/workflows/auto-tag.yml:21,42). GitHub does not fire downstream push events for refs pushed with the default GITHUB_TOKEN (this is intentional, to prevent workflow-triggering recursion). So publish.yml's on: push: tags: 'v*' trigger never sees the tag auto-tag.yml creates, and npm publish never runs.

Impact: every npx @hailbytes/security-headers / npm install invocation has been running 1.0.1 code for the last ~3 weeks (and indefinitely, until this is fixed), missing all subsequent grading-correctness fixes that landed in main (CSP base-uri/bare-scheme checks, HSTS revocation handling, referrer-policy/cross-origin scoring fixes, etc. — see #94 for the full list). This is a real, currently-live gap for anyone using the published package, not a cosmetic version mismatch.

This is a more precise root cause than #94, which attributes the drift to package.json not being committed back after publish — that's a real secondary issue, but it's moot right now because publish isn't happening at all.

Fix

Add a workflow_run trigger to publish.yml that fires when the Auto Tag workflow completes successfully — the same chaining pattern auto-tag.yml already uses off of CI (workflow_run: workflows: ["CI"]). This event type isn't subject to the GITHUB_TOKEN push restriction, since it's keyed off the completion of the upstream workflow run itself, not off a ref push.

• Check out github.event.workflow_run.head_sha (the exact commit auto-tag.yml tagged) when triggered this way, falling back to github.sha for the existing push/workflow_dispatch triggers.
• When not triggered by a direct tag push, resolve the version from the newest v* tag pointing at HEAD instead of parsing GITHUB_REF.
• Kept the existing push: tags: 'v*' and workflow_dispatch triggers as-is, so a manually/PAT-pushed tag or a manual run still works exactly as before.

Test plan

• .github/workflows/publish.yml YAML parses (python3 -c "import yaml; yaml.safe_load(open('.github/workflows/publish.yml'))")
• Next green run of CI on main → Auto Tag creates v1.0.4 → this workflow's workflow_run trigger fires → npm view @hailbytes/security-headers version shows 1.0.4 shortly after (needs NPM_PUBLISH_TOKEN to be valid; I can't trigger this from a PR branch)
• workflow_dispatch and direct push: tags paths still behave as before (unchanged logic, guarded by the same if [[ "$GITHUB_REF" == refs/tags/v* ]] branch)

Related: #94 (stale package.json/CHANGELOG.md — becomes actionable once publishing actually resumes).

---

Generated by Claude Code