chore: update publish workflow to include concurrency and improve clarity

Author: JonusNattapong

.github/workflows/publish.yml

@@ -1,21 +1,23 @@
-name: Publish to npm
-
-on:
-  push:
-    tags:
-      - 'v*'
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-  packages: write
-  id-token: write
-
-jobs:
-  publish:
-    name: Publish package
-    runs-on: ubuntu-latest
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish package
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
@@ -27,20 +29,25 @@ jobs:
           node-version: '18'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Publish to npm (using NPM_TOKEN)
-        if: secrets.NPM_TOKEN != ''
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Publish to npm (using NPM_TOKEN)
+        if: secrets.NPM_TOKEN != ''
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           echo "Publishing with NPM_TOKEN..."
           npm publish --access public
 
-      - name: Publish to npm (OIDC / Trusted Publisher)
-        if: secrets.NPM_TOKEN == ''
-        run: |
-          echo "No NPM_TOKEN found. To publish without a stored token, set up a Trusted Publisher in npm and enable OIDC."
-          echo "See README or npm docs for steps to configure Trusted Publisher."
-          exit 1
+      - name: Publish to npm (OIDC / Trusted Publisher)
+        if: secrets.NPM_TOKEN == ''
+        run: |
+          echo "No NPM_TOKEN found. Trying Trusted Publisher via OIDC..."
+          npm publish --access public --provenance