feat: gateway publishability + npmjs publish script (#370)

.woodpecker/publish.yml

@@ -35,8 +35,8 @@ steps:
       - |
         echo "//git.mosaicstack.dev/api/packages/mosaic/npm/:_authToken=$NPM_TOKEN" > ~/.npmrc
         echo "@mosaic:registry=https://git.mosaicstack.dev/api/packages/mosaic/npm/" >> ~/.npmrc
-      # Publish all non-private packages (--no-git-checks skips dirty/branch checks in CI)
-      # --filter excludes private apps (gateway, web) and the root
+      # Publish non-private packages to Gitea (--no-git-checks skips dirty/branch checks in CI)
+      # --filter excludes gateway (published to npmjs instead) and web (private)
       - >
         pnpm --filter "@mosaic/*"
         --filter "!@mosaic/gateway"
@@ -46,6 +46,20 @@ steps:
     depends_on:
       - build
 
+  publish-npmjs:
+    image: *node_image
+    environment:
+      NPM_TOKEN:
+        from_secret: npmjs_token
+    commands:
+      - *enable_pnpm
+      - apk add --no-cache jq bash
+      - bash scripts/publish-npmjs.sh
+    depends_on:
+      - build
+    when:
+      - event: [tag]
+
   build-gateway:
     image: gcr.io/kaniko-project/executor:debug
     environment: