ci: republish all packages with trusted publishing

Author: devfive

.changepacks/changepack_log_oidcPublish20260825.json

@@ -0,0 +1,18 @@
+{
+  "changes": {
+    "packages/core/package.json": "Patch",
+    "packages/fetch/package.json": "Patch",
+    "packages/generator/package.json": "Patch",
+    "packages/hookform/package.json": "Patch",
+    "packages/next-plugin/package.json": "Patch",
+    "packages/react-query/package.json": "Patch",
+    "packages/rsbuild-plugin/package.json": "Patch",
+    "packages/ui/package.json": "Patch",
+    "packages/utils/package.json": "Patch",
+    "packages/vite-plugin/package.json": "Patch",
+    "packages/webpack-plugin/package.json": "Patch",
+    "packages/zod/package.json": "Patch"
+  },
+  "note": "Publish all npm packages through OIDC with materialized workspace dependency versions",
+  "date": "2026-08-24T19:12:59.670Z"
+}

.github/workflows/publish.yml

@@ -22,7 +22,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.3.12
+          bun-version: latest
       - run: bun i
       - run: bun lint
       - run: bun run build
@@ -56,14 +56,34 @@ jobs:
           fetch-tags: true
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.4.0
+          bun-version: latest
       - name: Install Node.js
         uses: actions/setup-node@v7
         with:
           registry-url: "https://registry.npmjs.org"
           node-version: 24
       - run: bun i
       - run: bun run build
+      - name: Verify publish tarballs
+        shell: bash
+        run: |
+          set -euo pipefail
+          for manifest in packages/*/package.json; do
+            package_dir="$(dirname "$manifest")"
+            pack_dir="$RUNNER_TEMP/publish-verify/${package_dir//\//-}"
+            mkdir -p "$pack_dir"
+            (cd "$package_dir" && bun pm pack --quiet --destination "$pack_dir")
+            tarballs=("$pack_dir"/*.tgz)
+            if [[ "${#tarballs[@]}" -ne 1 ]]; then
+              echo "Expected one tarball for $package_dir" >&2
+              exit 1
+            fi
+            packed_manifest="$(tar -xOf "${tarballs[0]}" package/package.json)"
+            if grep -q 'workspace:' <<< "$packed_manifest"; then
+              echo "Unresolved workspace dependency in $package_dir" >&2
+              exit 1
+            fi
+          done
       - uses: changepacks/action@main
         id: changepacks
         with: