From 96582b79fdeb22377c506ddc5b54810d226b1fc2 Mon Sep 17 00:00:00 2001
From: leeguooooo <guoli@zhihu.com>
Date: Tue, 24 Feb 2026 17:20:17 +0900
Subject: [PATCH] =?UTF-8?q?ci(release):=20=E8=B0=83=E6=95=B4=20trusted=20p?=
 =?UTF-8?q?ublishing=20=E5=8F=91=E5=B8=83=E6=B5=81=E7=A8=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

将 changesets/action 改为仅处理 version/PR，不再由其执行 publish。

新增发布前版本检查与独立 pnpm ci:publish 步骤，避免 OIDC 发布在 action 内失败。
---
 .github/workflows/release.yml | 37 ++++++++++++++++++++++++++++++++---
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92f11d9..028c6e1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -142,8 +142,8 @@ jobs:
     needs: build-binaries
     runs-on: ubuntu-latest
     outputs:
-      published: ${{ steps.changesets.outputs.published }}
-      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
+      published: ${{ steps.publish_metadata.outputs.published }}
+      publishedPackages: ${{ steps.publish_metadata.outputs.publishedPackages }}
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
@@ -215,12 +215,43 @@ jobs:
         uses: changesets/action@v1
         with:
           version: pnpm ci:version
-          publish: pnpm ci:publish
           title: 'chore: version packages'
           commit: 'chore: version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Check if publish is needed
+        id: publish_check
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        run: |
+          LOCAL_VERSION=$(node -p "require('./package.json').version")
+          REMOTE_VERSION=$(npm view agent-browser-stealth version 2>/dev/null || echo "")
+          echo "local_version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
+          echo "remote_version=$REMOTE_VERSION" >> "$GITHUB_OUTPUT"
+          if [ "$LOCAL_VERSION" != "$REMOTE_VERSION" ]; then
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "Local:  $LOCAL_VERSION"
+          echo "Remote: ${REMOTE_VERSION:-<none>}"
+
+      - name: Publish to npm (trusted publishing)
+        id: publish_npm
+        if: steps.changesets.outputs.hasChangesets == 'false' && steps.publish_check.outputs.needs_publish == 'true'
+        run: pnpm ci:publish
+
+      - name: Set release outputs
+        id: publish_metadata
+        run: |
+          if [ "${{ steps.publish_npm.outcome }}" = "success" ]; then
+            echo "published=true" >> "$GITHUB_OUTPUT"
+            echo "publishedPackages=[{\"name\":\"agent-browser-stealth\",\"version\":\"${{ steps.publish_check.outputs.local_version }}\"}]" >> "$GITHUB_OUTPUT"
+          else
+            echo "published=false" >> "$GITHUB_OUTPUT"
+            echo "publishedPackages=[]" >> "$GITHUB_OUTPUT"
+          fi
+
   # Create GitHub release with binaries after npm publish
   github-release:
     name: Create GitHub Release