[abhis3]

The repo now publishes through OSS Exit Gate (the NPM_PUBLISH_VIA repository variable is exit-gate), so nothing goes through Wombat Dressing Room anymore, and Wombat stops working in January 2027. This removes the old path and makes Exit Gate the only one:

• test.yml: drops the Wombat Publish step with its npm token secrets, the registry-url that only that step needed, and the NPM_PUBLISH_VIA conditions on the Exit Gate steps.
• scripts/publish.js: drops the Wombat tokens, the direct npm publish to npm with provenance, and the opt-in switch (--use-oss-gate, NPM_PUBLISH_VIA, USE_OSS_GATE). It always stages to Exit Gate's Artifact Registry repository and writes the manifest.
• publish-exit-gate.yml: stops passing the unused --use-oss-gate flag.

What gets published doesn't change: canaries on pushes to main, latest/next on release tags (only the tagged package), and manual runs of publish-exit-gate.yml. Unreleased packages are still skipped.

Exit Gate is already publishing from this repo

These runs went through the same Exit Gate steps that this PR keeps, one run for each way a publish starts:

Trigger	Run	Result
Release tag (test.yml)	42864849634, prerelease build-v0.1.8-rc.0	Staged @apphosting/build@0.1.8-rc.0 and uploaded the manifest. About 6 minutes later Exit Gate published it to npm as google-wombot, under the next tag. latest stayed at 0.1.7.
Push to main (test.yml)	42850495137, the #712 merge	npm ci, the Exit Gate sign-in and the Artifact Registry login passed, and the Wombat step was skipped. No package changed, so the manifest upload was skipped.
Manual (publish-exit-gate.yml)	42700120038	Exit Gate published @apphosting/common@0.0.9-canary.857f6b2.42700120038.1 to npm as google-wombot, under the canary tag.

To check npm yourself: npm view @apphosting/build@0.1.8-rc.0 _npmUser.name prints google-wombot, and npm view @apphosting/build dist-tags shows next: 0.1.8-rc.0 and latest: 0.1.7.

After this merges, these can be deleted: the ADAPTER_ANGULAR_NPM_TOKEN, ADAPTER_ASTRO_NPM_TOKEN, ADAPTER_COMMON_NPM_TOKEN, ADAPTER_NEXTJS_NPM_TOKEN, FIREBASE_FRAMEWORKS_NPM_TOKEN and PERSONAL_NPM_TOKEN secrets, and the NPM_PUBLISH_VIA variable.

Testing

Dry runs of scripts/publish.js (PUBLISH_DRY_RUN=true) for

• a push with no package changes: empty manifest, so the upload is skipped
• a canary across several changed packages: canary versions and the canary tag, with @google-cloud/adapter-nextjs left out
• the build-v0.1.8 release tag: only @apphosting/build@0.1.8, tag latest
• a manual run filtered to @apphosting/common: per-run canary suffix
• a manual run filtered to the unreleased @google-cloud/adapter-nextjs: fails

ESLint and Prettier pass.

[gemini-code-assist]

Code Review

This pull request simplifies the publishing process in scripts/publish.js by removing the useOssGate flag and the legacy wombatDressingRoomTokens configuration. The script now exclusively uses the Exit Gate workflow, always ensuring the Exit Gate .npmrc is configured, deleting publishConfig from package.json, and generating the Exit Gate manifest. There are no review comments, and I have no feedback to provide.