ci: trigger post-merge publish and deploy on push to main

[jaysin586]

Mirror of humanspeak/svelte-motion#468 for this repo.

Why

GitHub withholds secrets from pull_request events triggered by fork PRs — including the merged closed event. Our post-merge npm publish and Cloudflare deploy both keyed off pull_request[closed], so external contributions merged to main silently failed to publish/deploy (first hit: humanspeak/svelte-motion#466).

What changed

Push-trigger migration

• npm-publish.yml and cloudflare-deploy.yml now run on push to main (plus workflow_dispatch), keeping the existing paths: filters. Push events always run in the base repo with secrets.
• Push payloads carry no PR context, so check-if-merged recovers the merged PR from the commit via listPullRequestsAssociatedWithCommit and exposes has_skip_label / has_major / has_minor / pr_number / pr_title / pr_url as job outputs. Every downstream step now consumes those outputs instead of github.event.pull_request.*; PR-comment steps are guarded on pr_number != ''. Direct pushes to main without an associated merged PR stay unpublished, matching the old behavior.

Action version bumps (all workflows + .trunk/setup-ci/action.yaml)

actions/checkout v6→v7, actions/setup-node v6→v7, actions/cache v5→v6, actions/upload-artifact v4→v7, actions/github-script v7→v9, actions/setup-python v6→v7, crazy-max/ghaction-import-gpg v6→v7.

Trunk unit-test upload hardening

The Vitest results upload to trunk-io/analytics-uploader in npm-publish.yml is now continue-on-error: true — telemetry only, so a flaky upload can never block a release (a "fetch failed" there blocked the svelte-motion v0.9.0 publish on 2026-08-12). vite.config.ts already emits junit-vitest.xml, matching the workflow's junit-paths.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ddaf43dc-e795-4289-b29b-1e7dd6ea0d15

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}