ci: npm trusted publishing (like bambu-printer-mcp); local code-review gate

.github/workflows/publish.yml

@@ -0,0 +1,57 @@
+name: Publish Package
+
+# Publishes to npm with GitHub Actions trusted publishing (OIDC, with
+# provenance): no npm token or 2FA code is stored or needed. Every merge to
+# main publishes its package.json version once; a version that is already on
+# npm is skipped. Requires the package's trusted publisher on npmjs.com to
+# point at this repository and this workflow file.
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          package-manager-cache: false
+
+      - name: Skip versions already on npm
+        id: version
+        run: |
+          name=$(node -p 'require("./package.json").name')
+          version=$(node -p 'require("./package.json").version')
+          if npm view "$name@$version" version >/dev/null 2>&1; then
+            echo "$name@$version is already published; nothing to do."
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - if: steps.version.outputs.publish == 'true'
+        run: npm ci
+
+      - if: steps.version.outputs.publish == 'true'
+        run: npm test
+
+      - if: steps.version.outputs.publish == 'true'
+        run: npm run test:package
+
+      - if: steps.version.outputs.publish == 'true'
+        run: npm publish

AGENTS.md

@@ -5,10 +5,11 @@ This file is the repository's shared source of truth for local agents, scheduled
 ## Release and review
 
 - Every update to main requires an npm patch version bump and publication, including code, documentation, and configuration. Run `npm version patch` once for the release and include its package.json and package-lock.json changes in the same integration to main. No changes means no release.
-- Use a PR to main. Include `@codex review` in change commit messages and request `@codex review` on the PR. After each update, wait at least five minutes and for review plus CI to complete on the current head. Inspect inline findings as well as summary comments; fix actionable findings and repeat. A stale review or passing local test does not authorize ignoring current CI failures.
+- Before opening or updating a PR, run Matt Pocock's `code-review` skill against the main merge base and resolve substantive findings locally. GitHub CI is the expensive gate, so it should only see reviewed work. Then use a PR to main and wait for CI on the current head; a passing local test does not authorize ignoring current CI failures. Codex review is not part of this process: don't put `@codex review` in commit messages or PR comments unless the maintainer asks for it.
 - Prioritize substantive defects and regressions in supported workflows. Document and defer obscure edge cases, speculative hardening, and cosmetic objections instead of extending a sound release into an endless review loop.
-- Publish from a clean build of the merged main commit, then create a `v<version>` tag and GitHub release with the accumulated changelog notes. Verify npm, the tag, the release, and a fresh `npx -y mcp-3d-printer-server` startup before declaring the release complete. Never move a published tag.
+- The main-branch Publish Package workflow (`.github/workflows/publish.yml`) runs the checks and `npm publish` with trusted publishing; do not publish from a local checkout. Verify that workflow and the exact npm version before claiming publication. Then create a `v<version>` tag and GitHub release with the accumulated changelog notes. Verify npm, the tag, the release, and a fresh `npx -y mcp-3d-printer-server` startup before declaring the release complete. Never move a published tag.
 - Changes to src/, scripts/, or printer behavior need a present-tense CHANGELOG.md entry under `## Unreleased`, including evidence limits (mocked transports versus real hardware).
+- Never add AI or agent attribution anywhere in Git or GitHub: no `Co-Authored-By` trailers for Claude, Codex, or other assistants, no "Generated with" footers, and no agent session links in commits, PR titles or bodies, review replies, issue comments, or release notes.
 - Preserve original authorship when integrating contributor PRs. Credit code, issue reports, hardware evidence, and useful superseded proposals in CONTRIBUTORS.md.
 
 ## Community triage