ci: gate the publish job, keep --test-force-exit (verified handle leak)

.github/workflows/npm-publish.yml

@@ -2,19 +2,44 @@
 
 on:
     release:
+        # 'published' — not 'created', which also fires when a *draft* release is saved and
+        # would push unreleased code to npm.
         types: [published]
 
 jobs:
-    publish:
+    # The same gate as CI, re-run here on purpose. A release is cut from a tag, and nothing
+    # guarantees that tag points at a commit CI ever saw — so verify before publishing rather
+    # than assume. npm publish is irreversible: a version cannot be replaced once taken.
+    build:
         runs-on: ubuntu-latest
         steps:
             - uses: actions/checkout@v7
             - uses: actions/setup-node@v7
               with:
+                  # This package declares engines >=20, so 20.x is its own baseline. The
+                  # template pins 22.x for repos that raised their floor above 20.
                   node-version: 20.x
-                  registry-url: https://registry.npmjs.org
             - run: npm ci
+            - run: npm run lint
+            - run: npm run format:check
             - run: npm test
-            - run: npm publish
+
+    publish-npm:
+        # Without this the publish runs regardless of the checks above.
+        needs: build
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v7
+            - uses: actions/setup-node@v7
+              with:
+                  node-version: 20.x
+                  registry-url: https://registry.npmjs.org
+            - run: npm ci
+            # A GitHub release flagged "pre-release" goes to the `beta` dist-tag, so users
+            # on Manage Palette — which tracks `latest` — are not auto-upgraded onto an
+            # unproven build. A plain `npm publish` would move `latest` to the beta and
+            # push it to every install; `latest` cannot be walked back to an earlier
+            # version by publishing, only by a separate dist-tag change.
+            - run: npm publish ${{ github.event.release.prerelease && '--tag beta' || '' }}
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/standards-check.yml

@@ -1,10 +1,14 @@
-# Optional: drop into a target repo as .github/workflows/standards-check.yml
+# Synced into target repos by `nrstd sync` as .github/workflows/standards-check.yml.
 # Fails CI if the repo drifts from the shared standard. Tool-neutral (no AI).
+# `nrstd audit` exits non-zero below 10/10, so a repo adopting this should run
+# `nrstd sync --write` first — otherwise its next push goes red on pre-existing drift.
 name: Standards check
 on:
     push:
         branches: [master, main]
     pull_request:
+permissions:
+    contents: read
 jobs:
     standards:
         runs-on: ubuntu-latest
@@ -13,6 +17,10 @@ jobs:
             - uses: actions/setup-node@v7
               with:
                   node-version: 20.x
-            # node-red-standards is not published to npm — install it from the repo, the same way
-            # it is invoked locally. `npx --yes node-red-standards` fails with E404.
+            # Resolved from Git, not the npm registry: this package is deliberately
+            # unpublished (README "Install", option B), so a bare
+            # `npx --yes node-red-standards` fails every run with E404 before it can
+            # audit anything — which reads as drift when it is really a missing
+            # package. The repo is public, so no token is needed. If it is ever
+            # published, the short form becomes available and this can go back.
             - run: npx --yes github:windkh/node-red-standards audit