chore: fix staging pipelines for 2.9.15

[transphorm]

Description

A brief description of the changes, what and how is being changed.

Tested

Explain how the change has been tested (for example by manual testing, unit tests etc) or why it's not necessary (for example version bump).

How to QA

How can the change be tested in a repeatable manner?

Summary by CodeRabbit

• Chores
  • Improved NPM publish workflow: added token validation, conditional publishing, consistent post-publish status reporting, and configurable continue-on-error behavior across all packages.
  • Updated react-native-svg dependency in the mobile SDK demo package.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds NPM token presence checks, strict-mode gating, continue-on-error handling, and unified publish-result reporting to the npm-publish GitHub Actions workflow; also downgrades react-native-svg in the mobile SDK demo package.

Changes

Cohort / File(s)	Summary
NPM Publish Workflow Enhancements .github/workflows/npm-publish.yml	Adds workflow input strict_mode and env STRICT_PUBLISH_MODE; introduces a pre-publish Check NPM Token step that sets token_available; gates publish steps on token_available == 'true'; adds a Publish result step (always runs) for each publish job to warn when skipped, failed, or succeeded; applies continue-on-error behavior to respect strict mode across all publish jobs (core, qrcode, common, contracts, qrcode-angular, msdk, mobile-sdk-alpha).
Mobile SDK Demo Dependencies packages/mobile-sdk-demo/package.json	Changes react-native-svg version from 15.15.1 to 15.12.1.

Sequence Diagram(s)

(omitted — changes are workflow-level and do not introduce a new multi-component runtime control flow that benefits from a sequence diagram)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• Feat/contracts npm publish #1089: Modifies the same npm-publish workflow; adds a publish-contracts job and contracts_changed output that overlap with publish gating and reporting.
• feat: use npm trusted publishing #1405: Alters authentication flow in .github/workflows/npm-publish.yml (OIDC vs token); closely related to token handling and publish conditions.
• SELF-701: Setup AlphaAlpha Publishing for mobile sdk #1296: Adds msdk change detection and a publish-msdk job; intersects with msdk/mobile-sdk-alpha publish steps adjusted here.

Suggested labels

codex

Suggested reviewers

• aaronmgdr
• remicolin
• shazarre

Poem

🔐 Secrets checked before the ship sets sail,
A gate that logs when tokens fail,
Warnings whisper, successes chime—
CI guards the publish time. ✨

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	Description contains only template placeholders with no actual content filled in; all sections are empty of meaningful information.	Provide concrete details on changes made, testing approach, and QA steps. Explain what fixes were applied to the staging pipelines.
Title check	❓ Inconclusive	Title references staging pipelines and version, but provides minimal specificity about the actual changes being made.	Consider adding context about what was fixed (e.g., 'chore: fix npm publish checks in staging pipelines for 2.9.15')

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch justin/fix-staging-pipelines-2_9_15

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5b5776df9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 2

🤖 Fix all issues with AI agents

In @.github/workflows/npm-publish.yml:
- Around line 99-120: The publish step ("Publish to npm", id: publish) currently
uses continue-on-error: true which masks real publish failures; remove that
step-level continue-on-error so the step fails visibly (or if you must not block
the job, move continue-on-error to the job-level instead and keep the step-level
failure), and add a TODO comment like "TODO: remove job-level continue-on-error
once token rotation is complete" to avoid it becoming permanent; ensure the
Publish result step then inspects steps.publish.outcome to report warnings or
success as intended.
- Around line 89-97: The "Check NPM Token" step currently interpolates ${{
secrets.NPM_TOKEN }} directly into the shell which risks injection; update the
step (id: check-token, name: Check NPM Token) to read the token from an
environment variable instead (e.g., set env: NPM_TOKEN: ${{ secrets.NPM_TOKEN
}}) and then reference $NPM_TOKEN inside the run block to check emptiness and
write token_available to $GITHUB_OUTPUT; apply the same change to the other
publish job steps that repeat this pattern.

🧹 Nitpick comments (1)

.github/workflows/npm-publish.yml (1)

89-120: Extract the token-check + publish-result pattern into a composite action.

The identical ~17-line block (Check NPM Token + conditional publish gate + Publish result) is copy-pasted across all 7 publish jobs. This is a significant DRY violation—any future change (e.g., the secret-interpolation fix above) must be applied in 7 places.

Consider creating a composite action (e.g., .github/actions/npm-publish-with-check) that encapsulates:

1. Token availability check
2. Conditional publish execution
3. Result reporting

Each job could then replace the boilerplate with a single action call, passing the working directory, access level, and tag as inputs.

Also applies to: 141-172, 192-223, 240-271, 291-322, 344-375