From 274a1d8c8f39c577a822d16ed591aba2c5979ab3 Mon Sep 17 00:00:00 2001
From: MaheshtheDev <38828053+MaheshtheDev@users.noreply.github.com>
Date: Fri, 16 Oct 2026 23:07:39 +0000
Subject: [PATCH] ci(tools): publish 2.x patches from release/tools-2.x under
 the legacy-2 dist-tag

Release-branch-only change. Pushes to release/tools-2.x that touch
packages/tools/package.json or this workflow publish through the same
trusted-publishing workflow file, with --provenance and --tag legacy-2 so
'latest' (3.x) never moves. The version check now looks up the exact
local version instead of comparing against 'latest', skips versions that
already exist, refuses anything that is not 2.x, and fails closed if npm
cannot be queried. Unit tests run before publish.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---
 .github/workflows/publish-tools.yml | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish-tools.yml b/.github/workflows/publish-tools.yml
index 8dfb8569a..862fbdbba 100644
--- a/.github/workflows/publish-tools.yml
+++ b/.github/workflows/publish-tools.yml
@@ -3,9 +3,10 @@ name: Publish Tools
 on:
     push:
         branches:
-            - main
-        paths: 
+            - release/tools-2.x
+        paths:
             - "packages/tools/package.json"
+            - ".github/workflows/publish-tools.yml"
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
@@ -38,26 +39,37 @@ jobs:
               uses: oven-sh/setup-bun@v2
 
             - name: Install dependencies
-              run: bun install
+              run: bun install --frozen-lockfile
 
             - name: Check if version changed
               id: version-check
               run: |
                 PACKAGE_NAME=$(jq -r '.name' package.json)
                 LOCAL_VERSION=$(jq -r '.version' package.json)
-                NPM_VERSION=$(npm view "$PACKAGE_NAME" version 2>/dev/null || echo "0.0.0")
-                if [ "$LOCAL_VERSION" = "$NPM_VERSION" ]; then
+                case "$LOCAL_VERSION" in
+                  2.*) ;;
+                  *) echo "::error::release/tools-2.x only publishes 2.x, found $LOCAL_VERSION"; exit 1 ;;
+                esac
+                if PUBLISHED=$(npm view "$PACKAGE_NAME@$LOCAL_VERSION" version 2>"$RUNNER_TEMP/npm-view.err") && [ -n "$PUBLISHED" ]; then
                   echo "Version $LOCAL_VERSION already published, skipping."
                   echo "changed=false" >> "$GITHUB_OUTPUT"
-                else
-                  echo "Publishing $LOCAL_VERSION (npm has $NPM_VERSION)"
+                elif [ -z "$PUBLISHED" ] && { [ ! -s "$RUNNER_TEMP/npm-view.err" ] || grep -q E404 "$RUNNER_TEMP/npm-view.err"; }; then
+                  echo "Publishing $LOCAL_VERSION under the legacy-2 dist-tag"
                   echo "changed=true" >> "$GITHUB_OUTPUT"
+                else
+                  cat "$RUNNER_TEMP/npm-view.err"
+                  echo "::error::Could not check whether $LOCAL_VERSION is already on npm"
+                  exit 1
                 fi
 
             - name: Build
               if: steps.version-check.outputs.changed == 'true'
               run: bun run build
 
+            - name: Unit tests
+              if: steps.version-check.outputs.changed == 'true'
+              run: bun run test:unit
+
             - name: Publish
               if: steps.version-check.outputs.changed == 'true'
-              run: npm publish --access public --provenance
+              run: npm publish --access public --provenance --tag legacy-2