Move publish to workflow_run after CI success

Remove the inline publish job from the main CI workflow and convert the publish workflow into a separate workflow_run that triggers when the CI workflow completes on the main branch. Add a guard to run only on successful CI runs, use the workflow_run head_sha for checkout, and simplify the paths-filter base to HEAD^. These changes decouple publishing from the main CI job and ensure the publish workflow runs against the exact commit that finished the CI.

Author: neSpecc

.github/workflows/main.yml

@@ -29,8 +29,3 @@ jobs:
 
       - name: Build
         run: yarn build
-
-  publish:
-    needs: check-lint-test-build
-    if: github.ref == 'refs/heads/main'
-    uses: ./.github/workflows/publish.yml

.github/workflows/publish.yml

@@ -1,22 +1,27 @@
 name: Publish
 
 on:
-  workflow_call:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
 
 jobs:
   publish:
+    if: github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
         with:
+          ref: ${{ github.event.workflow_run.head_sha }}
           fetch-depth: 0
 
       - name: Detect changed packages
         id: changes
         uses: dorny/paths-filter@v3
         with:
-          base: ${{ github.event.before || 'HEAD^' }}
+          base: HEAD^
           filters: |
             utils:
               - 'packages/utils/**'