[howaskew]

Summary

Fixes the publish loop guard, makes the publish safe to rerun, moves publishing to Node 18, and brings package.json back in line with npm.

Changes

Publish workflow (publish-to-npm.yaml)

• Loop guard. The if: checked for hello@openactive.io, but the bot has committed as 207210293+openactive[bot] since May 2025, so a successful push of the version bump would start another publish. The job now skips runs started by openactive[bot], and the version bump commit message carries a skip-CI marker, so the guard does not depend on an email address.
• Push before publishing. The version bump is pushed to main before npm publish. If the push is rejected, the job stops and nothing is published, so npm cannot get ahead of GitHub.
• Node 18.17.1 instead of Node 14 for the publish job. npm ci and npm test pass locally on 18.17.1 (28 passing).
• Publishes with a repository-level npm token.
• One publish runs at a time; permissions reduced to contents: read; actions/setup-node v4.

Version

• package.json and package-lock.json set to 1.0.4, which has been on npm since April 2023 but whose version bump never reached main. Without this, every release would try to publish 1.0.4 again and npm would reject it.

Verification

• actionlint: no issues.
• A simulated version bump produces the commit message 1.0.5 with the skip-CI marker, authored by openactive[bot], changing only package.json and package-lock.json.

When merged

Merging starts a publish: tests, bump to 1.0.5, push, publish. 1.0.5 contains the same code as 1.0.4 plus the CI changes merged since 2023. If the push to main is rejected, the run stops before publishing and nothing changes.

When squash-merging, check the suggested commit message does not contain a skip-CI marker, or no workflows will run.

Note: the required test (10.x), test (12.x) and test (14.x) checks have not run for some time; if Node 10 or 12 no longer installs on current runners, the test matrix will need updating before this can merge.