Automate WP npm publishing from GHCR builds

[gigitux]

What?

Automates the wp-X.Y npm publishing path from the Gutenberg plugin build pipeline.

When build-plugin-zip.yml successfully publishes the mutable GHCR build tag for a wp/X.Y branch, it now calls the npm publishing workflow as a reusable workflow with release_type: wp and the branch ref as wp_version.

The npm workflow now also supports workflow_call and, for the wp path, verifies the source it is about to publish by:

• pulling ghcr.io/wordpress/gutenberg/gutenberg-wp-develop-build:wp-X.Y
• reading .gutenberg-hash from the build artifact
• normalizing wp/X.Y to the npm dist-tag version X.Y
• confirming the checked-out wp/X.Y branch matches that SHA
• publishing packages with only the mutable wp-X.Y dist-tag

Background

Historically, the WordPress release process had a more direct package-preparation path for the @wordpress/* npm packages consumed by Core releases. That path is no longer prepared from the Gutenberg side in the same way, so the wp-X.Y npm dist-tags can be left behind unless someone manually runs the npm publishing workflow.

#78211 added a better source of truth for the build that WordPress consumes: Gutenberg now publishes a GHCR artifact with both an immutable SHA tag and a mutable stream tag such as wp-7.0. The artifact also includes .gutenberg-hash, which records the exact Gutenberg commit used for that build.

This PR connects that newer GHCR build signal to the existing npm publishing workflow. The GHCR wp-X.Y tag remains the build pointer, and the npm wp-X.Y dist-tag is updated only after the workflow verifies that the checked-out wp/X.Y branch matches the SHA recorded in the GHCR artifact.

Why?

The GHCR build introduced in #78211 gives Gutenberg a mutable wp-X.Y artifact that represents the build WordPress can consume. The npm package publishing flow still had to be triggered separately, so wp-7.0 dist-tags could be missing even when the matching GHCR build existed.

This connects the two steps while keeping the SHA verification explicit before npm publish mutates package dist-tags.

Testing Instructions

• Review the workflow graph for build-plugin-zip.yml and confirm trigger-wp-npm-publish only runs after publish-to-container-registry succeeds on wp/** branches.
• Confirm publish-npm-packages.yml still supports manual workflow_dispatch.
• Confirm the wp path pulls the GHCR wp-X.Y artifact and verifies .gutenberg-hash before running Lerna.

Checks run

• Parsed all workflow YAML files with Ruby YAML.load_file.
• Ran git diff --check.
• Ran Prettier for the touched workflow files.

Note: commit hooks were bypassed in the temporary clean worktree because Husky's generated helper was not installed there; the relevant checks above were run manually.

[github-actions]

Warning: Type of PR label mismatch

To merge this PR, it requires exactly 1 label indicating the type of PR. Other labels are optional and not being checked here.

• Required label: Any label starting with [Type].
• Labels found: .

Read more about Type labels in Gutenberg. Don't worry if you don't have the required permissions to add labels; the PR reviewer should be able to help with the task.

[Copilot]

Pull request overview

Automates the WordPress (wp/X.Y) npm publishing flow by chaining it from the existing Gutenberg plugin GHCR build pipeline, and adds safeguards to ensure the npm publish source matches the GHCR build’s recorded commit.

Changes:

• Add workflow_call support to publish-npm-packages.yml, including a wp publishing path that pulls the wp-X.Y GHCR artifact and verifies .gutenberg-hash matches the checked-out wp/X.Y branch SHA before publishing.
• Update build-plugin-zip.yml to call the npm publishing workflow after successfully publishing the mutable wp-X.Y GHCR tag on wp/** branches.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/publish-npm-packages.yml	Adds reusable workflow support and a GHCR-backed SHA verification gate for wp publishing.
.github/workflows/build-plugin-zip.yml	Triggers the wp npm publishing workflow after the GHCR publish job on wp/** branches.