fix(ci): npm publish fails with Cannot find module 'yargs'

[khvn26]

The npm publish step of the release workflow fails:

Error: Cannot find module 'yargs'
Require stack:
- /home/runner/work/_temp/gnp/dist/cli.cjs

(see the v2.0.0 run)

The reason for this is we avoid installing dependencies for goreleaser-npm-publisher while holding an Actions token with the id-token: write permission (which is required for trusted publishing).

The dependencies do have to be installed, however. In this PR, we install them with --mode=skip-build, which ensures that any install/post-install scripts are skipped. I have confirmed that none of goreleaser-npm-publisher's dependencies need them.

This workaround will be removed along with the goreleaser-npm-publisher fork once evg4b/goreleaser-npm-publisher#26 is released.

We're also adding a workflow_dispatch trigger to the release workflow, allowing it to run against an arbitrary tag, which should help us release 2.0.0 to npm.

[coderabbitai]

Warning

Review limit reached

@khvn26, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dcb95abe-8b18-442d-b19b-7aa3837805d6

📥 Commits

Reviewing files that changed from the base of the PR and between f278f10 and 87546a9.

📒 Files selected for processing (1)

• .github/workflows/release.yml

📝 Walkthrough

Walkthrough

The release workflow now supports manual dispatch for npm republishing from an existing tag. Manual runs select and check out the requested tag, build the distribution structure, restore and verify published binaries, and skip Docker, attestations, beta promotion, and installer jobs. Push-triggered releases retain the release flow. The npm publisher installs dependencies with build and post-install scripts disabled.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🔴 Critical · up to f278f

The new manual release path can currently check out branch or pull-request code while running with write and OIDC permissions, allowing untrusted code to execute with privileged access; this must be restricted to tags before merge. The artifact-selection step also needs fail-fast handling to avoid publishing with incomplete selections.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e4d83249-5ef1-4054-b9f9-2282016e3eb4

📥 Commits

Reviewing files that changed from the base of the PR and between 8efdce3 and f278f10.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.