fix(ci): publish only from main when version is unpublished

[coffeexcoin]

Summary

• move trusted publishing off pull_request_target and onto push to main
• add a detect job that compares the local package version against npm
• only run verify and publish when the local version is not yet published
• update release docs to match the new flow

Testing

• not run locally

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mpp-abstract-mpp-demo	Ready	Preview, Comment	Mar 26, 2026 1:24am

[changeset-bot]

⚠️ No Changeset found

Latest commit: 085f8c3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cursor]

PR Summary

Medium Risk
Changes the npm publish trigger and gating logic; misconfiguration could cause skipped releases or unintended publishes on pushes to main. Uses npm view version comparison, so correctness depends on registry availability and package metadata.

Overview
The Publish GitHub Action now runs on push to main (instead of pull_request_target) and uses github.ref for concurrency grouping.

It adds a detect job that compares the local packages/mpp/package.json version with the version on npm, and only runs verify and publish when the local version has not been published yet. RELEASING.md is updated to document the new release flow.

^{Written by Cursor Bugbot for commit 085f8c3. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Version check compares against latest, not specific version

Low Severity

The npm view @abstract-foundation/mpp version command returns only the latest dist-tag version, not whether the specific local version exists on the registry. The intent (per PR description and RELEASING.md) is to publish "when the local version is not yet published," but this check actually tests "when the local version differs from latest." If a version bump is ever reverted on main, the local version could be an already-published older version that differs from latest, causing the workflow to attempt a redundant publish that fails. Using npm view @abstract-foundation/mpp@$local_version version would correctly check whether the exact local version is already published.