Sync main into main-convert - #403

chore: release main

Three workflows still bootstrapped yarn via `yarn set version berry`
(a Yarn v1 escape hatch) before installing. Since 38cc9a9 pinned
`"packageManager": "yarn@4.10.3"` in package.json, the runner's
pre-installed Yarn 1.22.22 refuses to operate against the project
and errors with "Corepack must currently be enabled" — failing the
first push to main after the pin.

Concrete fallout from PR #390's merge:
- pages.yml: failed at "Installing npm packages"
- release-please.yml publish jobs: failed at "Install deps" for
  packages/types, packages/utils, packages/js-sdk — leaving the
  v3.13.0 / v2.4.0 / v4.4.2 releases created on GitHub but never
  published to npm.
- publish-package.yml: same defect, latent until next manual
  workflow_dispatch.

Replace the v1 bootstrap with `corepack enable` +
`corepack prepare yarn@4.10.3 --activate` (matching the
package.json pin), then a plain `yarn` install — same pattern
qa.yml already uses successfully.

Also bumps pages.yml's `actions/setup-node@v1` and
`actions/checkout@v2` to `@v4` (both prior versions are EOL).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ad-only

Plain `yarn` in CI is *effectively* immutable because Yarn 4 enables
`enableImmutableInstalls` when `CI=true` (which GitHub Actions
auto-sets). Relying on that is brittle — `--immutable` makes the
intent explicit and fails loudly with YN0028 if yarn.lock would be
mutated, instead of depending on environment auto-detection.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(ci): bootstrap yarn via corepack to match packageManager pin

The previous flow authenticated `npm publish` with a long-lived
`NPM_TOKEN` secret whose per-package allowlist couldn't be
inspected or rotated by the convertcom org owners. Result: out of
13 `@convertcom/js-sdk-*` packages, only `js-sdk` and
`js-sdk-cloudflare` could be published (last success: 2026-04-06);
publishes for `types`, `utils`, `rules`, etc. have been 404'ing on
the registry PUT for months — 7 GitHub-tagged versions never made
it to npm.

With Trusted Publishers (per npm docs at
https://docs.npmjs.com/trusted-publishers), authentication moves to
GitHub OIDC, configured per package by the npm org owners. Each
package's npm settings now lists this workflow file as a trusted
publisher, so the workflow needs three changes:

1. Grant the job `id-token: write` so the runner can mint an OIDC
   token for npm to validate.
2. Upgrade the bundled npm CLI to >= 11.5.1 (Node 22 ships 10.9.x);
   OIDC publish support requires the newer CLI.
3. Drop the `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` env from
   each publish step — OIDC replaces it; leaving the token in
   would defeat the security gain.

Also pins `actions/checkout@v4` to the tag passed via
`workflow_dispatch -f tag=<tag>` (or the release event's
`tag_name`), so backfill dispatches build the *tagged commit's*
source — not main HEAD — which is required to publish the 7
missing prior versions (e.g. dispatching `js-sdk-types-v3.12.0`
must build the 3.12.0 source, not the current 3.13.0 in
`packages/types/package.json` on main).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ublisher

fix(ci): switch publish-package.yml to npm Trusted Publishers (OIDC)

The `publish` job duplicated `publish-package.yml` (which now publishes
via npm Trusted Publishers / OIDC after #395) and was the last consumer
of the `NPM_TOKEN` secret. `release-please.yml` now only manages
versions, changelogs, tags, and GitHub Releases; the `release:
published` event continues to trigger `publish-package.yml` for the
actual npm publish.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…e-please-publish-job

chore(ci): remove redundant publish job from release-please.yml

…orkflow

The `Updating Github pages` workflow has been failing on every push
to main since the Karma→Playwright migration (commit be7e235). Two
issues, both fixed here:

1. **Build runs AFTER test, but the integration test requires the
   build output.** `tests/integration/full-chain.spec.ts:5` does
   `require('../../lib/index')` at module load time. `lib/` is the
   rollup output produced by `yarn build`. The current step order
   in `Generating coverage and docs` was `yarn test` then `yarn
   build`, so Playwright's test-file discovery crashed with
   `Error: Cannot find module '../../lib/index'` before any browser
   even launched.

2. **Playwright's bundled chromium was never installed.** The
   workflow installs system `google-chrome-stable` (a Karma-era
   leftover), but Playwright uses its own bundled chromium binary,
   not the system Chrome. Without `playwright install`, the
   browser tests would have failed at browser-launch time even
   after fixing (1).

`qa.yml` already had both pieces in place — that's why PR-time
checks have been passing while `pages.yml` has been red on every
merge. This change brings `pages.yml` into alignment.

The system Chrome install block is left untouched here — removing
it is scope-creep cleanup that should be a separate PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(ci): build before test and install Playwright browsers in pages workflow