ci: trigger post-merge publish and deploy on push to main

[jaysin586]

Mirror of humanspeak/svelte-motion#468.

Why

GitHub withholds repository secrets from pull_request events triggered by fork PRs — including the merged closed event. Since npm-publish and cloudflare-deploy triggered on pull_request[closed], publishes and deploys silently failed whenever an external contribution merged (first hit: svelte-motion PR #466).

What changed

Push-trigger migration

• npm-publish.yml and cloudflare-deploy.yml now trigger on push to main (existing paths: filters and workflow_dispatch kept). Push events always run in the base repo with secrets.
• Push payloads carry no PR context, so check-if-merged recovers the merged PR from the commit via listPullRequestsAssociatedWithCommit (github-script@v9) and exposes has_skip_label / has_major / has_minor / pr_number / pr_title / pr_url outputs. Every downstream github.event.pull_request.* reference now reads those outputs; PR-comment steps are guarded on pr_number != ''.
• Direct pushes to main without an associated merged PR do not publish — same behavior as the old trigger. The version-bump commit is [skip ci], so it cannot retrigger the workflow.

Action version bumps

• actions/setup-python v6 → v7, actions/stale v10 → v11. (checkout/setup-node/cache/upload-artifact/github-script/codeql/import-gpg were already current in this repo.)

Trunk unit-test upload hardening

• Added Upload Vitest Results (junit-vitest.xml) to the build job and Upload Playwright Results (test-results/junit-playwright.xml) to the playwright job in npm-publish.yml, both trunk-io/analytics-uploader@main with if: always() and continue-on-error: true — telemetry only, a flaky upload must never block a release.
• playwright.config.ts now writes its junit report to test-results/junit-playwright.xml so the uploader and the existing playwright-results artifact both find it. Vitest already emitted junit-vitest.xml via vite.config.ts.

Note: these uploads rely on TRUNK_ORG_SLUG / TRUNK_TOKEN secrets being present in the ci environment — worth double-checking before merge.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 895cf503-c5be-4cc6-8ebc-9d7d3695158d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}