ci: gate the publish job, keep --test-force-exit (verified handle leak)

[windkh]

Picks up part of the node-red-standards 0.4.1 fixes. The test-script change is deliberately not taken — see below.

npm-publish.yml — the release had almost no gate

It was one job running npm ci → npm test → npm publish. No lint, no format:check, and no job separation, so nothing stood between a tag and an irreversible publish except the test suite. Now the standard's two-job shape: build runs lint, format:check and test, and publish-npm declares needs: build.

It also used a plain npm publish, so a release flagged pre-release would have gone to latest and auto-upgraded every Manage Palette user onto an unproven build. Now routed to the beta dist-tag.

Node stays on 20.x rather than the template's 22.x — that pin exists for repos that raised their floor above the standard's >=20 baseline. This package declares >=20.

standards-check.yml — refresh only

This repo already had the correct Git-resolved invocation (it was ahead of the standard here). Same command, plus the contents: read permissions block.

⚠️ The test script deliberately KEEPS --test-force-exit

The standard dropped the flag because it masks handle leaks. This repo has one. Without the flag the suite doesn't finish — it hangs:

• Full run killed at the 480 s timeout (exit 124) after 204 passing tests, with over seven minutes of no output.
• Reproduces in isolation:

  node --test --test-timeout=30000 --test-concurrency=1 test/login-endpoints.test.js
  → 16 pass, then hangs (exit 124)
  

--test-timeout does not catch it, because the leak holds the process open after the tests themselves have finished.

This is precisely the trade-off the standard documents: the flag is what stops the run hanging, and it can only come out once the open handle in test/login-endpoints.test.js is closed. Worth fixing separately — a suite that exits on its own also proves it leaks nothing. Until then this is a recorded deviation, not an oversight.

🤖 Generated with Claude Code