From 1e2df7d2895ef02761e8e07cf8ddac836b3e0575 Mon Sep 17 00:00:00 2001
From: Charles Hudson <charles.hudson@contentful.com>
Date: Fri, 5 Jun 2026 11:34:43 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=9A=80=20ci(publishing):=20Updating=20pub?=
 =?UTF-8?q?lishing=20workflows=20for=20manual=20publish=20parity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Also making the git commit hook fail fast if the lockfile wasn't updated
appropriately.

[[NT-3351](https://contentful.atlassian.net/browse/NT-3351)]
---
 .github/workflows/publish-android.yaml | 15 +++++++++++++++
 .github/workflows/publish-npm.yaml     |  4 +++-
 .github/workflows/publish-spm.yaml     |  6 ++++++
 .husky/pre-commit                      | 11 ++++++++++-
 4 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-android.yaml b/.github/workflows/publish-android.yaml
index 7a283517..71af4041 100644
--- a/.github/workflows/publish-android.yaml
+++ b/.github/workflows/publish-android.yaml
@@ -11,6 +11,10 @@ on:
       tag:
         description: 'Existing release tag (e.g. v1.2.3)'
         required: true
+      publish:
+        description: 'Actually publish'
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -51,11 +55,22 @@ jobs:
 
       - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
 
+      - name: Verify Maven publishing assembles
+        if: github.event_name == 'workflow_dispatch' && !inputs.publish
+        working-directory: packages/android/ContentfulOptimization
+        env:
+          RELEASE_VERSION: ${{ env.RELEASE_VERSION }}
+        run: |
+          ./gradlew publishToMavenLocal \
+            -Pcontentful.optimization.version="$RELEASE_VERSION" \
+            --no-configuration-cache --no-daemon --console=plain
+
       # Build the signed AAR (+ sources/javadoc/POM) and publish+release it to Maven Central via the
       # Sonatype Central Portal. vanniktech reads credentials and the in-memory GPG key from the
       # ORG_GRADLE_PROJECT_* env vars below, populated from the Actions secrets that
       # scripts/setup-maven-central-credential.sh provisions.
       - name: Publish to Maven Central
+        if: github.event_name == 'release' || inputs.publish
         working-directory: packages/android/ContentfulOptimization
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
diff --git a/.github/workflows/publish-npm.yaml b/.github/workflows/publish-npm.yaml
index cad95f3e..1d62ef99 100644
--- a/.github/workflows/publish-npm.yaml
+++ b/.github/workflows/publish-npm.yaml
@@ -23,6 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Retrieve Secrets from Vault
+        if: github.event_name == 'release' || inputs.publish
         id: vault
         uses: hashicorp/vault-action@4c06c5ccf5c0761b6029f56cfb1dcf5565918a3b # v3.4.0
         with:
@@ -45,7 +46,7 @@ jobs:
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || github.sha }}
+          ref: ${{ github.event_name == 'release' && github.event.release.tag_name || inputs.tag }}
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -86,6 +87,7 @@ jobs:
           retention-days: 3
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        if: github.event_name == 'release' || inputs.publish
         with:
           node-version-file: '.nvmrc'
           registry-url: 'https://npm.pkg.github.com'
diff --git a/.github/workflows/publish-spm.yaml b/.github/workflows/publish-spm.yaml
index 5a5fbe24..b16b0606 100644
--- a/.github/workflows/publish-spm.yaml
+++ b/.github/workflows/publish-spm.yaml
@@ -11,6 +11,10 @@ on:
       tag:
         description: 'Existing release tag (e.g. v1.2.3)'
         required: true
+      publish:
+        description: 'Actually publish'
+        type: boolean
+        default: false
 
 jobs:
   publish:
@@ -61,6 +65,7 @@ jobs:
           test -f "$RUNNER_TEMP/pkg/Sources/ContentfulOptimization/Resources/optimization-ios-bridge.umd.js"
 
       - name: Set up the deploy key for SSH push
+        if: github.event_name == 'release' || inputs.publish
         env:
           MIRROR_DEPLOY_KEY: ${{ secrets.SPM_MIRROR_DEPLOY_KEY }}
         run: |
@@ -70,6 +75,7 @@ jobs:
           ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
 
       - name: Commit, tag, and push to the distribution repo
+        if: github.event_name == 'release' || inputs.publish
         run: |
           git clone --depth 1 git@github.com:contentful/optimization.swift.git mirror
           # --delete so files removed in the monorepo also disappear from the mirror
diff --git a/.husky/pre-commit b/.husky/pre-commit
index f23159b9..20e1dc46 100644
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,3 +1,12 @@
 #!/bin/bash
 
-pnpm exec lint-staged --allow-empty
+set -e
+
+LINT_STAGED="node_modules/.bin/lint-staged"
+
+if [ ! -x "$LINT_STAGED" ]; then
+  echo "lint-staged is not installed. Run 'pnpm install --frozen-lockfile' before committing."
+  exit 1
+fi
+
+"$LINT_STAGED" --allow-empty