From b9dbf1593a007dab0e82884ac2f1d76efdb7bce3 Mon Sep 17 00:00:00 2001
From: mheyen <malte.heyen@posteo.de>
Date: Tue, 4 Aug 2026 18:13:33 +0200
Subject: [PATCH 1/2] ci: use softprops/action-gh-release for ui publish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the raw `gh release create` call with
softprops/action-gh-release@v3 (asset globbing, generated release
notes). Drops workflow_dispatch — GitHub requires the trigger to exist
at the dispatched ref itself, so it couldn't backfill pre-migration
tags.
---
 .github/workflows/publish.yml | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9ec05eb..67cd848 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,16 +7,13 @@ name: Publish ui package
 # @basicbar/ui is packed with `npm pack` and attached as a GitHub Release
 # asset — a plain public tarball URL, no npm registry/account/token needed
 # (same rationale as the GitLab Generic Package Registry before the move).
+# Only ui/v* tags trigger this — auth/integrations/lti packages are Django
+# packages installed straight from the archive-tarball URL, no publish job.
 
 on:
   push:
     tags:
       - "ui/v*"
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Bestehender Tag, für den nachträglich ein Release-Asset erzeugt werden soll (z. B. ui/v0.2.1) — als 'Use workflow from' auswählen, dieses Feld ist nur zur Doku"
-        required: false
 
 permissions:
   contents: write
@@ -38,17 +35,16 @@ jobs:
           if [ "$VERSION" != "$PKG_VERSION" ]; then
             echo "Tag $GITHUB_REF_NAME ≠ package.json-Version $PKG_VERSION"; exit 1
           fi
-          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
 
       - run: cd packages/ui && npm ci --no-fund --no-audit
       - run: cd packages/ui && npm run build
       - run: cd packages/ui && npm pack
 
-      - name: Attach tarball to GitHub Release
+      - name: Create release
+        uses: softprops/action-gh-release@v3
         env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh release create "$GITHUB_REF_NAME" \
-            "packages/ui/basicbar-ui-$VERSION.tgz" \
-            --title "$GITHUB_REF_NAME" \
-            --notes "Siehe CHANGELOG.md für Migrationsschritte."
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          files: packages/ui/basicbar-ui-*.tgz
+          fail_on_unmatched_files: true
+          generate_release_notes: true

From a32a832f0081f58177f1ed67d5c7ea9100a5944f Mon Sep 17 00:00:00 2001
From: mheyen <malte.heyen@posteo.de>
Date: Tue, 4 Aug 2026 18:27:08 +0200
Subject: [PATCH 2/2] ci: bump actions/checkout, publish releases as draft
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

actions/checkout@v4 -> v7. Releases are created as drafts so there's a
manual review/publish step before a new @basicbar/ui version becomes
publicly installable. Drops the explicit GITHUB_TOKEN env — the action
already defaults its token input to github.token.
---
 .github/workflows/publish.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 67cd848..c4d9b66 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
   ui-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - uses: actions/setup-node@v4
         with:
@@ -42,9 +42,8 @@ jobs:
 
       - name: Create release
         uses: softprops/action-gh-release@v3
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           files: packages/ui/basicbar-ui-*.tgz
           fail_on_unmatched_files: true
           generate_release_notes: true
+          draft: true