fix(release): skip already-published npm packages so job reruns are idempotent

[smorin]

npm hard-rejects publishing over an existing version, so a rerun of a partially-failed publish-npm job dies on the platform packages before reaching togl-cli (exactly what happened on v0.5.1: all four platform packages published with provenance, then the wrapper's stale trusted-publisher config failed it, and reruns were blocked). Each publish now checks the registry first and skips existing versions — the npm equivalent of uv publish --check-url.

Merging this as fix: triggers the v0.5.2 release PR, whose gated release will publish all five npm packages (wrapper included) via OIDC — completing the npm destination and validating the corrected trusted publishers end to end.

https://claude.ai/code/session_014DjTALJi3LJhYmrdpw6Rej

Summary by CodeRabbit

• Bug Fixes
  • Improved release publishing to safely handle previously published package versions.
  • Prevents duplicate publication attempts for platform packages and the CLI.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 605c5708-1a5e-4c29-89ce-394690a87750

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The release workflow now checks whether each package version exists on npm before publishing, skipping packages that are already available.

Changes

npm publishing

Layer / File(s)	Summary
Registry-aware release publishing .github/workflows/release.yml	The publish-npm job checks platform packages and togl-cli at the release VERSION, publishing only versions absent from the npm registry.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• smorin/toggle#46: Introduces the npm publishing chain updated by this workflow change.

Suggested reviewers: copilot

Poem

I’m a rabbit guarding the release lane,
Checking npm through sun and rain.
If a version’s there, I let it be,
If not, I publish happily.
No duplicate hops—just carrots for me!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: making the release job skip already-published npm packages for idempotent reruns.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR makes the npm release workflow rerunnable by skipping npm publish for packages that already exist at the release tag’s version, avoiding npm’s hard failure on republishing the same version. This directly improves reliability of the publish-npm job when a prior run partially succeeded.

Changes:

• Add per-package registry prechecks (npm view <pkg>@<version>) before publishing platform packages.
• Add a similar precheck for the togl-cli wrapper package so reruns can proceed past already-published artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}