ci: delete unreachable npm-token publish jobs from build-wasm and build-native (LAB-1390)

[27Bslash6]

Summary

This PR removes dead, unreachable npm publish jobs from two CI workflows and documents why publishing is handled elsewhere.

Changes

.github/workflows/build-native.yml

• Deletes the entire publish job that was gated on cachekit-core-ts-v* tags. This job never actually ran: GitHub App-created release tags don't trigger the workflow, and the repo has no NPM_TOKEN secret, so it would have failed with ENEEDAUTH regardless.
• Adds a header comment explaining that this workflow now builds and tests only, that core-ts publishing has always been manual, and warns against re-adding npm-token auth.
• Updates an inline comment to reflect that full cross-platform validation runs on push to main and on manually pushed cachekit-core-ts-v* tags, feeding the (currently manual) publish process.

.github/workflows/build-wasm.yml

• Deletes the publish job (and the Upload artifact step it depended on). This job also could not authenticate — its single lifetime run failed with ENEEDAUTH.
• Adds a header comment clarifying that this workflow builds only, and that all wasm publishing goes through release-please.yml's publish-cachekit-core-wasm job using pnpm OIDC trusted publishing.

.github/workflows/release-please.yml

• Updates a comment noting that the cachekit-core-ts outputs are currently unconsumed, since App-created tags don't trigger build-native.yml and core-ts publishing remains manual.

Impact

• Removes non-functional publish paths that could never succeed, reducing confusion and maintenance surface.
• No change to actual publishing behavior: wasm continues to publish via release-please.yml, and core-ts publishing remains manual.
• The workflows now serve strictly as build/test validation.
• Establishes clear documentation (referencing LAB-831 and LAB-1390) that a working CI publish path for core-ts is deferred as follow-up work.

Summary by CodeRabbit

• Release Process
  • Native and WebAssembly build workflows now focus on building and testing only.
  • Automated package publishing has been removed from CI workflows.
  • Publishing instructions are now manual, with release automation guidance updated accordingly.
  • Release notes clarify that core package publishing remains manual, with a future CI publishing path planned.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 000cb18a-c953-4b2d-920c-cad82f6d1e68

📥 Commits

Reviewing files that changed from the base of the PR and between 5e2182e and 1fac57e.

📒 Files selected for processing (3)

• .github/workflows/build-native.yml
• .github/workflows/build-wasm.yml
• .github/workflows/release-please.yml

---

Walkthrough

The CI workflows now build and validate native and Wasm packages without publishing them. Comments document manual native publishing, release-please behaviour, recovery tags, and GitHub App-created tag limitations.

Changes

CI publishing control

Layer / File(s)	Summary
Native build-only workflow .github/workflows/build-native.yml	The workflow documents manual native-package publishing, updates validation comments, and removes the tag-gated publish job.
Wasm and release path alignment .github/workflows/build-wasm.yml, .github/workflows/release-please.yml	The workflows document build-only Wasm behaviour, manual publishing, recovery-tag handling, and GitHub App-created tag behaviour.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• cachekit-io/cachekit-ts#41: Adds related cross-platform native artifact publishing logic.
• cachekit-io/cachekit-ts#45: Fixes npm authentication in the removed publishing path.
• cachekit-io/cachekit-ts#85: Modifies related Wasm publishing and App-created tag handling.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: removing unreachable npm-token publishing jobs from the native and Wasm build workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lab-1390-dead-npm-token-publish-paths

---

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[27Bslash6]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.