fix(ci): comprehensive workflow improvements for reliable releases

Summary of changes:

1. Fixed --ignore pattern in ats.release.yml:
   - Changed from non-existent @hashgraph/mass-payout* to correct @mass-payout/* namespace

2. Simplified publish triggers in ats.publish.yml and mp.publish.yml:
   - Changed from release.published event to push.tags for automatic publishing
   - Tag push (v*-ats or v*-mp) now directly triggers publish workflow
   - No need to manually create GitHub release first

3. Removed recursive publish scripts:
   - Removed "publish": "npm publish" from contracts and SDK package.json
   - These caused npm to recursively call itself during publish lifecycle
   - Root cause of 403 errors and double-publish attempts in CI

4. Updated workflow documentation:
   - Moved .github/workflows/README.md to .github/WORKFLOWS.md
   - Updated diagrams and instructions to reflect tag-based triggers
   - Fixed --ignore patterns in manual release documentation

Signed-off-by: Miguel_LZPF <miguel.carpena@io.builders>

Author: MiguelLZPF

.changeset/fix-recursive-publish.md

@@ -0,0 +1,17 @@
+---
+"@hashgraph/asset-tokenization-contracts": patch
+"@hashgraph/asset-tokenization-sdk": patch
+---
+
+fix: CI workflow improvements for reliable releases
+
+1. **Fixed --ignore pattern in ats.release.yml**: Changed from non-existent
+   `@hashgraph/mass-payout*` to correct `@mass-payout/*` package namespace
+
+2. **Simplified publish trigger in ats.publish.yml**: Changed from
+   `release: published` to `push.tags` for automatic publishing on tag push
+   (no need to manually create GitHub release)
+
+3. **Removed recursive publish scripts**: Removed `"publish": "npm publish"`
+   from contracts and SDK package.json files that caused npm to recursively
+   call itself during publish lifecycle, resulting in 403 errors in CI

.github/workflows/README.md .github/WORKFLOWS.md.github/workflows/README.md renamed to .github/WORKFLOWS.md

@@ -96,10 +96,10 @@ For non-feature changes, add these labels to skip changeset requirement:
 
 ### Automatic Publishing
 
-| Workflow                | Trigger             | Purpose                     |
-| ----------------------- | ------------------- | --------------------------- |
-| **ATS Publish**         | Release tag `*-ats` | Publish ATS packages to npm |
-| **Mass Payout Publish** | Release tag `*-mp`  | Publish MP packages to npm  |
+| Workflow                | Trigger           | Purpose                     |
+| ----------------------- | ----------------- | --------------------------- |
+| **ATS Publish**         | Tag push `v*-ats` | Publish ATS packages to npm |
+| **Mass Payout Publish** | Tag push `v*-mp`  | Publish MP packages to npm  |
 
 ## Release Process
 
@@ -121,12 +121,12 @@ sequenceDiagram
 
     Dev->>GH: Trigger ATS Release Workflow
     GH->>GH: Validate ATS changesets exist
-    GH->>M: Run changeset version --ignore MP
-    GH->>M: Commit version changes to main
-    GH->>M: Create tag v1.16.0-ats
-    GH->>GH: Create GitHub release
-    GH->>NPM: Auto-trigger publish workflow
-    NPM->>NPM: Publish contracts & SDK
+    GH->>M: Run changeset version --ignore MP packages
+    GH->>M: Commit version changes
+    GH->>M: Push tag v1.16.0-ats
+    Note over GH,NPM: Tag push auto-triggers publish workflow
+    GH->>NPM: Publish contracts & SDK
+    Note over GH: GitHub release created (optional, for notes)
 ```
 
 #### Mass Payout Release Flow
@@ -140,12 +140,12 @@ sequenceDiagram
 
     Dev->>GH: Trigger MP Release Workflow
     GH->>GH: Validate MP changesets exist
-    GH->>M: Run changeset version --ignore ATS
-    GH->>M: Commit version changes to main
-    GH->>M: Create tag v2.4.0-mp
-    GH->>GH: Create GitHub release
-    GH->>NPM: Auto-trigger publish workflow
-    NPM->>NPM: Publish MP packages
+    GH->>M: Run changeset version --ignore ATS packages
+    GH->>M: Commit version changes
+    GH->>M: Push tag v2.4.0-mp
+    Note over GH,NPM: Tag push auto-triggers publish workflow
+    GH->>NPM: Publish MP packages
+    Note over GH: GitHub release created (optional, for notes)
 ```
 
 #### Release Options
@@ -202,11 +202,17 @@ sequenceDiagram
 2. **Apply changesets and version packages**:
 
    ```bash
-   # For ATS release
-   npx changeset version --ignore "@hashgraph/mass-payout*"
-
-   # For Mass Payout release
-   npx changeset version --ignore "@hashgraph/asset-tokenization-*"
+   # For ATS release (ignore all Mass Payout packages)
+   npx changeset version \
+     --ignore "@mass-payout/contracts" \
+     --ignore "@mass-payout/sdk" \
+     --ignore "@mass-payout/backend" \
+     --ignore "@mass-payout/frontend"
+
+   # For Mass Payout release (ignore all ATS packages)
+   npx changeset version \
+     --ignore "@hashgraph/asset-tokenization-contracts" \
+     --ignore "@hashgraph/asset-tokenization-sdk"
    ```
 
 3. **Commit version changes**:
@@ -221,10 +227,15 @@ sequenceDiagram
    - Create PR from `release/v1.22.2-ats` to `main`
    - Review and merge the version changes
 
-5. **Create GitHub release**:
-   - Create tag `v1.22.2-ats` on main branch
-   - Create GitHub release with generated changelog
-   - Publishing workflows trigger automatically
+5. **Create and push tag**:
+
+   ```bash
+   git tag v1.22.2-ats
+   git push origin v1.22.2-ats
+   ```
+
+   - Tag push automatically triggers publish workflow
+   - Optionally create GitHub release for release notes
 
 6. **Sync main back to develop**:
    ```bash
@@ -269,11 +280,12 @@ sequenceDiagram
     end
 
     Note over M: Ready for release
-    M->>GH: Manual release trigger
-    GH->>M: Version packages + create tag
-    GH->>GH: Create GitHub release
-    GH->>NPM: Auto-trigger publish
-    NPM->>NPM: Publish to NPM
+    M->>GH: Manual release workflow trigger
+    GH->>M: Version packages
+    GH->>M: Push tag (e.g., v2.0.0-ats)
+    Note over GH,NPM: Tag push auto-triggers publish
+    GH->>NPM: Publish to NPM
+    Note over GH: GitHub release optional (for notes)
 
     M->>D: Sync version changes back
 ```

.github/workflows/ats.publish.yml

@@ -10,10 +10,11 @@ on:
         type: boolean
         default: false
 
-  # Release published trigger (GitHub release creation) - only for ATS releases (tags ending with -ats)
-  release:
-    types:
-      - published
+  # Tag push trigger - simpler and automatic (no need to create GitHub release)
+  push:
+    tags:
+      - "v*-ats"
+      - "v*-ATS"
 
 defaults:
   run:
@@ -27,8 +28,8 @@ jobs:
   contracts:
     name: Publish ATS Contracts
     runs-on: token-studio-linux-large
-    # Only run if manual trigger OR release tag contains/ends with '-ats'/'-ATS'
-    if: ${{ github.event_name == 'workflow_dispatch' || contains(github.ref_name, '-ats-') || endsWith(github.ref_name, '-ats') }}
+    # Only run if manual trigger OR tag push (already filtered by v*-ats pattern)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
 
     steps:
       - name: Harden Runner
@@ -82,8 +83,8 @@ jobs:
   sdk:
     name: Publish ATS SDK
     runs-on: token-studio-linux-large
-    # Only run if manual trigger OR release tag contains/ends with '-ats'/'-ATS'
-    if: ${{ github.event_name == 'workflow_dispatch' || contains(github.ref_name, '-ats-') || endsWith(github.ref_name, '-ats') }}
+    # Only run if manual trigger OR tag push (already filtered by v*-ats pattern)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
     # needs: contracts  # Commented out for parallel execution
 
     steps:

.github/workflows/ats.release.yml

@@ -87,7 +87,12 @@ jobs:
         run: |
           echo "🚀 Releasing ATS packages only (ignoring Mass Payout packages)"
 
-          npx changeset version --ignore "@hashgraph/mass-payout*"
+          # Ignore all mass-payout packages (they use @mass-payout/* namespace)
+          npx changeset version \
+            --ignore "@mass-payout/contracts" \
+            --ignore "@mass-payout/sdk" \
+            --ignore "@mass-payout/backend" \
+            --ignore "@mass-payout/frontend"
 
           if [[ -n "$(git status --porcelain)" ]]; then
             echo "✅ Version bump completed for ATS packages"

.github/workflows/mp.publish.yml

@@ -10,10 +10,11 @@ on:
         type: boolean
         default: false
 
-  # Release published trigger (GitHub release creation) - only for Mass Payout releases (tags ending with -mp)
-  release:
-    types:
-      - published
+  # Tag push trigger - simpler and automatic (no need to create GitHub release)
+  push:
+    tags:
+      - "v*-mp"
+      - "v*-MP"
 
 defaults:
   run:
@@ -27,8 +28,8 @@ jobs:
   mass-payout:
     name: Publish Mass Payout Packages
     runs-on: token-studio-linux-large
-    # Only run if manual trigger OR release tag contains 'mp'
-    if: ${{ github.event_name == 'workflow_dispatch' || contains(github.ref_name, '-mp') }}
+    # Only run if manual trigger OR tag push (already filtered by v*-mp pattern)
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'push' }}
 
     steps:
       - name: Harden Runner

packages/ats/contracts/package.json

@@ -67,7 +67,6 @@
     "deploy:hedera:mainnet": "NETWORK=hedera-mainnet npm run deploy",
     "local:hardhat": "npx hardhat node",
     "deploy:hardhat": "npx hardhat run scripts/cli/hardhat.ts",
-    "publish": "npm publish",
     "compile": "npx hardhat compile",
     "compile:traces": "npx hardhat --show-stack-traces compile",
     "compile:force": "npx hardhat compile --force",

packages/ats/sdk/package.json

@@ -22,7 +22,6 @@
     "build": "rimraf build && tsc -p tsconfig.json && tsc-alias -p tsconfig.json && tsc -p tsconfig.cjs.json && tsc-alias -p tsconfig.cjs.json",
     "test": "NODE_OPTIONS=--max-old-space-size=16384 npx jest --ci --runInBand --detectOpenHandles --forceExit",
     "clean": "npm run clean:build && npm run clean:cache && npm run clean:coverage",
-    "publish": "npm publish",
     "prepack": "npm run build",
     "clean:build": "npx --yes rimraf build",
     "clean:cache": "npx --yes rimraf cache",