fix(ci): skip publish when the version is unchanged, and tag releases

[ericviana]

Problem

publish.yaml runs on every push to main and unconditionally calls npm publish, so any merge that does not bump the version fails the run:

npm error You cannot publish over the previously published versions: 4.0.2.

That just happened twice, on #52 and #58.

The noise is the actual risk here. A permanently red publish job is exactly how blindpay-cli's genuinely broken publish went unnoticed for two and a half months, leaving npm three versions behind while main moved on. A job that is always red tells you nothing when it breaks for real.

Changes

• Skip when the version is already on the registry. Same guard already merged into blindpay-cli (Add new endpoint for swift code check #19) and blindpay-mcp (Add rtp bank account method #9), so the three TypeScript-side repos now behave identically.
• Tag and create a GitHub release on publish. This repo has published up to 4.0.2 on npm and has zero git tags, so there is no way to tell from the repo alone what shipped in any release.
• Drop ref: ${{ github.head_ref }}, which is empty on a push event.

Authentication is unchanged: this repo already publishes via npm trusted publishing (OIDC), which is why @blindpay/node@4.0.2 carries SLSA provenance attestations. The comment added above the publish step records why NODE_AUTH_TOKEN must not be reintroduced, since adding it is what broke cli.

Verification

publish.yaml parses as valid YAML. The guard logic is identical to the two already merged and verified: both @blindpay/cli@0.4.0 and @blindpay/mcp@1.5.0 published successfully through it, with provenance.

Out of scope, but worth flagging

• .changeset/ holds roughly 20 accumulated changeset files and no workflow consumes them. main.yaml only runs lint, typecheck, tests and snyk. So version bumps are in practice manual edits to package.json, and the changesets are dead weight. Worth either wiring up changeset version or removing changesets.
• main currently carries the Handle empty JSON responses #52 and [Snyk] Upgrade svix from 1.89.0 to 1.94.0 #58 fixes at an unbumped 4.0.2, so both are unreleased. The next version bump ships them.

https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs

[BernardoSM]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.