[nabheet]

Same defect as nabheet/pcbway-mcp-server#71, in this repo's copy of the publish job.

The race

Version came from npm view opencode-rtk-plugin@latest plus a patch. That packument read is CDN-cached for a minute or two, so a second shipping merge inside the window computed a version that was already published and the run died with E409 Cannot publish over previously staged version. Nothing was lost (the next push picked the change up), but the merge showed a red run and cut no release.

The second defect: the conflict regex was case-sensitive while npm prints Cannot publish over, so the conflict was not recognised and the loop retried a pinned version three times at ~50s each.

Fixes

• Baseline = max(newest stable vX.Y.Z tag, registry latest). The tag is pushed right after a successful publish and does not lag; the registry stays because it also records a publish whose tag push failed. An ahead package.json is still honoured.
• fetch-depth: 0 on the publish checkout. Without it the tag list is only whatever the shallow clone happened to include, which would make the new baseline silently low.
• Bump on conflict (latest only, bounded at two bumps); beta channels still fail fast because their versions are already unique. The tag and release read package.json after publishing, so they follow the bump.
• Case-insensitive conflict match on npm's real output: cannot publish over, previously published, previously staged, npm error code E409.
• Plain tags only: sort -V ranks 1.0.0-rc.1 above 1.0.0 and any word above any number, so candidates are filtered to ^v[0-9]+\.[0-9]+\.[0-9]+$.
• Registry read failures now warn instead of looking like "no baseline".

Verification

actionlint clean (shellcheck is installed, so run: blocks are shellchecked). Derivation and publish-loop logic exercised outside CI over the case table in the umbrella issue: stale registry → tag wins; registry ahead of tag → registry wins; no sources → tree version as-is; ahead package.json → honoured; rc/beta/word tags ignored.

Scope note

This repo publishes a patch on every push to main (no release guard here), so merging this cuts a release. It is a workflow-only change, so that release carries no code change.

Reviewed

Adversarial review of the pcbway version of this diff found stale header comments, a log line printed before the bump, a silent registry-read failure, an over-broad e409 match, and the sort -V ordering trap — all fixed here. Reviewer had no shell; each claim was verified by running the logic.