feat(workflows): add force-registry and skip-npm-packages flags

Add workflow inputs to control publishing behavior:
- force-registry: Force publish @socketsecurity/registry regardless of version
- skip-npm-packages: Skip publishing npm override packages (packages/*)

Update flag handling to properly combine multiple flags.

Author: jdalton

.github/workflows/_local-not-for-reuse-provenance.yml

@@ -19,6 +19,16 @@ on:
         required: false
         default: false
         type: boolean
+      force-registry:
+        description: 'Force publish @socketsecurity/registry regardless of version changes'
+        required: false
+        default: false
+        type: boolean
+      skip-npm-packages:
+        description: 'Skip publishing npm override packages (packages/*)'
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: write
@@ -30,6 +40,8 @@ jobs:
     with:
       debug: ${{ inputs.debug }}
       force-publish: ${{ inputs.force-publish }}
-      publish-script: 'package-npm-publish'
+      force-registry: ${{ inputs.force-registry }}
+      skip-npm-packages: ${{ inputs.skip-npm-packages }}
+      publish-script: 'package-npm-publish' # runs scripts/publish-npm-packages.mjs
       setup-script: 'pnpm run build'
       use-trusted-publishing: true

.github/workflows/provenance.yml

@@ -21,6 +21,16 @@ on:
         required: false
         type: boolean
         default: false
+      force-registry:
+        description: 'Force publish @socketsecurity/registry regardless of version changes'
+        required: false
+        type: boolean
+        default: false
+      skip-npm-packages:
+        description: 'Skip publishing npm override packages (packages/*)'
+        required: false
+        type: boolean
+        default: false
       node-version:
         description: 'Node version to use (e.g., "20", "22", "24")'
         required: false
@@ -128,8 +138,18 @@ jobs:
       - name: Publish with custom script (token-based)
         if: inputs.publish-script != '' && inputs.use-trusted-publishing == false
         run: |
+          FLAGS=""
           if [ "${{ inputs.force-publish }}" = "true" ]; then
-            pnpm run ${{ inputs.publish-script }} -- --force-publish
+            FLAGS="$FLAGS --force-publish"
+          fi
+          if [ "${{ inputs.force-registry }}" = "true" ]; then
+            FLAGS="$FLAGS --force-registry"
+          fi
+          if [ "${{ inputs.skip-npm-packages }}" = "true" ]; then
+            FLAGS="$FLAGS --skip-npm-packages"
+          fi
+          if [ -n "$FLAGS" ]; then
+            pnpm run ${{ inputs.publish-script }} -- $FLAGS
           else
             pnpm run ${{ inputs.publish-script }}
           fi
@@ -139,8 +159,18 @@ jobs:
       - name: Publish with custom script (trusted publishing)
         if: inputs.publish-script != '' && inputs.use-trusted-publishing == true
         run: |
+          FLAGS=""
           if [ "${{ inputs.force-publish }}" = "true" ]; then
-            pnpm run ${{ inputs.publish-script }} -- --force-publish
+            FLAGS="$FLAGS --force-publish"
+          fi
+          if [ "${{ inputs.force-registry }}" = "true" ]; then
+            FLAGS="$FLAGS --force-registry"
+          fi
+          if [ "${{ inputs.skip-npm-packages }}" = "true" ]; then
+            FLAGS="$FLAGS --skip-npm-packages"
+          fi
+          if [ -n "$FLAGS" ]; then
+            pnpm run ${{ inputs.publish-script }} -- $FLAGS
           else
             pnpm run ${{ inputs.publish-script }}
           fi