[drkjc]

Changes

• publish.yml:
  • Remove the stage-only token path used for the first release, so every release publishes with npm trusted publishing (OIDC) and the GitHub Release is created published instead of as a draft
  • Set the SBOM's root component name to the package name, since npm sbom names it after the checkout folder
• README.md: point the Client SDK links to @spreedly/composer-sdk-client

[Copilot]

🟢 Approval recommended

The changes consistently remove staging behavior while preserving OIDC permissions and requiring successful npm publishing before GitHub Release creation.

No open issues 🎉

What changed in this PR

This PR simplifies release automation to publish exclusively through npm trusted publishing (OIDC) and create published GitHub Releases.

Changes:

• Removes the stage-only token, staging step, and staged output.
• Makes npm publishing unconditional within the publish job.
• Removes draft handling from GitHub Release creation.

File	Description
.github/​workflows/​publish.yml	Removes staging and draft-release behavior while retaining OIDC publishing.

_{Review effort: Balanced}

[Samy-O7]

Approving at c057e8b. Checked:

• The stage-only token path is fully removed: no stage step, NPM_STAGE_TOKEN or draft-release handling is left. The publish job has only contents: read and id-token: write, and the release job creates the GitHub Release published.
• Running the Pack step's npm sbom and the new rename locally gives an SBOM whose root is @spreedly/composer-sdk-server; the 1.0.0 SBOM was named after the checkout folder (composer-sdk-server-node). The package has no runtime dependencies, so no components are missing.
• Both Client SDK links in the README now point to https://www.npmjs.com/package/@spreedly/composer-sdk-client.