docs(ci): correct the publish root-cause comment; self-trigger on workflow changes

[jaruesink]

Summary

• Correct the publish-workflow history: the July 9 outage came from a stale npm Trusted Publisher binding after the repository was recreated, not from npm skipping OIDC because setup-node wrote a placeholder token.
• Trigger the publish workflow when its own configuration changes so future repairs validate automatically after merge.
• Run the repository's formatting gate alongside lint, typecheck, and tests before publishing.

Verification

• bun run lint
• bun run format:check
• bun run typecheck
• bun test
• docs / audit artifacts updated when behavior changed — not applicable; this changes release workflow guidance and validation only.

Review checklist

• I updated rule/report evidence, not just implementation text — not applicable; no audit or rule behavior changed.
• I called out AI-authored or generated content that needs extra scrutiny — the original correction was generated with Claude Code and was reviewed against the workflow diff.
• I noted follow-up guardrails or drift risk if this is intentionally partial — publish now self-triggers on workflow changes and enforces all four required gates.

Root-cause note

The merged comment previously recorded a mechanism that later verification disproved. npm attempts OIDC unconditionally; the placeholder token's actual effect was to disguise the stale-binding failure as a 404 instead of ENEEDAUTH. The binding was repaired by deleting and re-adding the Trusted Publisher configuration on npmjs.com on 2026-07-13.

[coderabbitai]

📝 Walkthrough

Walkthrough

The publish workflow now re-runs when its own file changes on main, adds a conditional formatting check, and revises trusted-publishing comments to explain stale publisher bindings and the removal of registry-url.

Changes

Publish workflow

Layer / File(s)	Summary
Workflow trigger, checks, and trusted-publishing documentation .github/workflows/publish.yml	The push path list includes the workflow itself, the publish gate runs bun run format:check when needed, and comments describe trusted-publisher binding failures and clearer authentication error reporting.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related PRs

• lambda-curry/anvil#74: Updates the same publish workflow’s trusted-publishing setup, including OIDC configuration and removal of NPM_TOKEN.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly matches the main changes: correcting the publish root-cause note and making the workflow self-trigger on its own changes.
Description check	✅ Passed	The description follows the template well, with complete Summary, Verification, and Review checklist sections plus relevant details.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-root-cause-comment

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 15-18: Add a bun run format:check validation step to the publish
workflow before the publish stage, alongside the existing lint, typecheck, and
test checks. Keep the current validation order and publishing behavior otherwise
unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: c268546c-1a84-4277-8dc2-1dafa5ce8690

📥 Commits

Reviewing files that changed from the base of the PR and between 64a8dfc and 4c79c2c.

📒 Files selected for processing (1)

• .github/workflows/publish.yml