ci: use npm stage publish

.github/workflows/build.yml

@@ -32,6 +32,9 @@ jobs:
           node-version: 24.x
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Install npm CLI for staged publishing
+        run: npm install -g npm@^11.15.0
+
       # Required by the `bun run changelog:ai` step below.
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -60,7 +63,7 @@ jobs:
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
         run: bun run changelog:ai
 
-      - name: Publish all packages to npm
+      - name: Stage all packages to npm
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
@@ -74,15 +77,27 @@ jobs:
           fi
 
           echo "Publishing with tag: $NPM_TAG"
+          npm --version
 
           # Publish each package
           for pkg in core cli android ios; do
             echo "Publishing @capacitor-plus/$pkg@$VERSION"
             cd $pkg
-            npm publish --tag $NPM_TAG --provenance --access public
+            npm stage publish --tag $NPM_TAG --provenance --access public --ignore-scripts
             cd ..
           done
 
+      - name: Request stage approval
+        continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.NPM_STAGE_DISPATCH_TOKEN }}
+        run: |
+          gh api --method POST repos/Cap-go/automations/dispatches \
+            -f event_type=npm-stage-approve \
+            -f "client_payload[repository]=${GITHUB_REPOSITORY}" \
+            -f "client_payload[run_id]=${GITHUB_RUN_ID}" \
+            -f "client_payload[package]=@capacitor-plus/core"
+
       - name: Create GitHub release
         id: create_release
         uses: softprops/action-gh-release@v3

.github/workflows/pr_beta_prompt.yml

@@ -71,7 +71,6 @@ jobs:
                   '',
                   'The workflow will:',
                   '- publish a prerelease package on the `beta` tag',
-                  `- add a pinned \`pr-${pr.number}\` dist-tag for the selected package`,
                   '- update this comment with the install command',
                   '',
                   'Security note: beta publish is only enabled for branches inside this repository.',

.github/workflows/pr_beta_publish.yml

@@ -160,7 +160,7 @@ jobs:
               `Package: \`${packageSelector}\``,
               `Requested by @${actor}.`,
               '',
-              `This run will publish the PR head for the selected Capacitor Plus package to the \`beta\` npm tag and refresh \`pr-${prNumber}\`.`,
+              `This run will publish the PR head for the selected Capacitor Plus package to the \`beta\` npm tag.`,
               '',
               `Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
             ].join('\n');
@@ -204,6 +204,9 @@ jobs:
           node-version: 24.x
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Install npm CLI for staged publishing
+        run: npm install -g npm@^11.15.0
+
       - name: Install dependencies
         run: npm install
 
@@ -302,18 +305,25 @@ jobs:
           cd "$PACKAGE_DIR"
           npm run build
 
-      - name: Publish to npm beta
+      - name: Stage publish to npm beta
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
           PACKAGE_DIR: ${{ steps.package.outputs.package_dir }}
         run: |
           cd "$PACKAGE_DIR"
-          npm publish --tag beta --provenance --access public --ignore-scripts
+          npm --version
+          npm stage publish --tag beta --provenance --access public --ignore-scripts
 
-      - name: Add PR dist-tag
+      - name: Request stage approval
+        continue-on-error: true
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npm dist-tag add "${{ steps.version.outputs.package_name }}@${{ steps.version.outputs.version }}" "pr-${{ steps.pr.outputs.pr_number }}"
+          GH_TOKEN: ${{ secrets.NPM_STAGE_DISPATCH_TOKEN }}
+        run: |
+          gh api --method POST repos/Cap-go/automations/dispatches \
+            -f event_type=npm-stage-approve \
+            -f "client_payload[repository]=${GITHUB_REPOSITORY}" \
+            -f "client_payload[run_id]=${GITHUB_RUN_ID}" \
+            -f "client_payload[package]=${{ steps.version.outputs.package_name }}"
 
       - name: Publish success comment
         if: ${{ success() }}
@@ -332,7 +342,7 @@ jobs:
               '',
               '## Beta npm build',
               '',
-              'Status: published',
+              'Status: staged',
               '',
               `Package: \`${packageDir}\` (${packageName})`,
               `Version: \`${version}\``,
@@ -342,11 +352,7 @@ jobs:
               'Latest beta:',
               '```sh',
               `npm install ${packageName}@beta`,
-              '```',
-              '',
-              'This PR only:',
-              '```sh',
-              `npm install ${packageName}@pr-${prNumber}`,
+              `npm install ${packageName}@${version}`,
               '```',
               '',
               `Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,