fix: cli release workflow

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
           cache: 'npm'
           registry-url: 'https://npm.pkg.github.com'
           scope: '@logfoxai'
+
+      - name: Check package.json deps
+        run: node scripts/check-no-file-deps.mjs
       - name: Configure npm auth
         run: |
           echo "@logfoxai:registry=https://npm.pkg.github.com/" > .npmrc

.github/workflows/release.yml

@@ -3,23 +3,28 @@ on:
   push:
     branches: [main]
   workflow_dispatch:
+permissions:
+  id-token: write   # Required for npm trusted publishing (OIDC)
+  contents: write   # Required for autorel to push release tag (and changelog)
 jobs:
   release:
+    name: Release
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
+    concurrency:
+      group: deploy-${{ github.ref }}
+      cancel-in-progress: false
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           fetch-tags: true
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
+          node-version: '24'   # npm 11+ required for trusted publishing (OIDC)
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'npm'
       - run: npm ci
-      - run: npm run build
-      - run: npx autorel@^2 --publish-args="--provenance"
+      - run: npm run validate
+      - run: npx autorel@^2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

package.json

@@ -21,7 +21,8 @@
     "build": "tsc",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",
-    "validate": "npm run build"
+    "validate": "npm run check:package-json && npm run build",
+    "check:package-json": "node scripts/check-no-file-deps.mjs"
   },
   "devDependencies": {
     "@types/node": "^24.13.2",

scripts/check-no-file-deps.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+/**
+ * Fail if package.json declares file: or file:// dependency specs.
+ * Canonical copy: infra/ci-cd/check-no-file-deps.mjs
+ * Service repos ship an identical copy at scripts/check-no-file-deps.mjs for CI.
+ *
+ * Local monorepo dev uses npm link — never commit file: paths.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const DEP_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies",
+  "overrides",
+];
+
+const pkgPath = join(process.cwd(), "package.json");
+let pkg;
+try {
+  pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+} catch (err) {
+  console.error(`check-no-file-deps: failed to read ${pkgPath}: ${err.message}`);
+  process.exit(1);
+}
+
+const violations = [];
+
+function isFileSpec(value) {
+  return typeof value === "string" && (value.startsWith("file:") || value.startsWith("file://"));
+}
+
+function checkDeps(deps, path) {
+  if (!deps || typeof deps !== "object" || Array.isArray(deps)) {
+    return;
+  }
+  for (const [name, version] of Object.entries(deps)) {
+    if (isFileSpec(version)) {
+      violations.push(`${path}.${name}: ${JSON.stringify(version)}`);
+    } else if (version && typeof version === "object") {
+      checkDeps(version, `${path}.${name}`);
+    }
+  }
+}
+
+for (const field of DEP_FIELDS) {
+  checkDeps(pkg[field], field);
+}
+
+if (violations.length > 0) {
+  console.error("package.json must not use file: or file:// dependency specs.");
+  console.error("Use npm link for local development instead.");
+  for (const v of violations) {
+    console.error(`  ${v}`);
+  }
+  process.exit(1);
+}
+
+console.log("check-no-file-deps: ok");