fix(release): Restore web-app install for npm publish

Install apps/web-app dependencies in the publish workflow before the\nfrontend build so CI matches the working Pages pipeline.\n\nHarden the maintainer release suite by adding the same install step\nbefore app:build, and switch the shared app:install helper to npm ci\nfor deterministic installs.\n\nDocument the follow-up patch release in the changelog so 8.7.1 can\npublish the 8.7.x line to npm after the 8.7.0 release failed before\nreaching the registry.

.github/workflows/publish-npm.yml

@@ -48,6 +48,9 @@ jobs:
       - name: Run docs security checks
         run: npm run security:docs
 
+      - name: Install web-app dependencies
+        run: npm run app:install
+
       - name: Build web app
         run: npm run app:build
 

CHANGELOG.md

@@ -9,6 +9,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.7.1] - 2026-03-23 - "Release Pipeline Repair"
+
+> Patch release to restore npm publication after the `v8.7.0` GitHub Release failed before reaching the npm registry.
+
+Start here:
+
+- Install: `npx antigravity-awesome-skills`
+- Choose your tool: [README -> Choose Your Tool](https://github.com/sickn33/antigravity-awesome-skills#choose-your-tool)
+- Best skills by tool: [README -> Best Skills By Tool](https://github.com/sickn33/antigravity-awesome-skills#best-skills-by-tool)
+- Bundles: [docs/users/bundles.md](https://github.com/sickn33/antigravity-awesome-skills/blob/main/docs/users/bundles.md)
+- Workflows: [docs/users/workflows.md](https://github.com/sickn33/antigravity-awesome-skills/blob/main/docs/users/workflows.md)
+
+This patch release keeps the `8.7.0` skill/library content intact and fixes the release pipeline so npm publication works end-to-end again. The root cause was that the publish workflow only installed root dependencies before building `apps/web-app`, leaving the web app without its own `node_modules` in CI.
+
+## Improvements
+
+- **npm publish repair**: Updated the publish workflow to install `apps/web-app` dependencies before the web build, matching the working GitHub Pages workflow and preventing the missing-React/missing-Vite TypeScript cascade seen in CI.
+- **Release verification hardening**: Added deterministic web-app installation to the maintainer release suite so `release:preflight` and `release:prepare` now catch this class of failure before a GitHub Release is published.
+- **Deterministic installs**: Switched the shared `app:install` script to `npm ci` so local and CI web-app installs use the same locked dependency graph.
+
+## Who should care
+
+- **Maintainers** can cut releases again without the publish workflow failing during the web-app build.
+- **npm users** can finally receive the `8.7.x` catalog and skill updates through the package registry instead of being stuck on `8.4.0`.
+- **Web-app contributors** get a cleaner release contract where CI explicitly prepares the frontend before building it.
+
 ## [8.7.0] - 2026-03-23 - "Reference Recovery and Release Reliability"
 
 > Installable skill library update for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and related AI coding assistants.

package.json

@@ -43,7 +43,7 @@
     "sync:all-official": "npm run sync:microsoft && npm run chain",
     "update:skills": "node tools/scripts/run-python.js tools/scripts/generate_index.py && node tools/scripts/copy-file.js skills_index.json apps/web-app/public/skills.json && node tools/scripts/copy-file.js skills_index.json apps/web-app/public/skills.json.backup",
     "app:setup": "node tools/scripts/setup_web.js",
-    "app:install": "cd apps/web-app && npm install",
+    "app:install": "cd apps/web-app && npm ci",
     "app:dev": "npm run app:setup && cd apps/web-app && npm run dev",
     "app:build": "npm run app:setup && cd apps/web-app && npm run build",
     "app:preview": "cd apps/web-app && npm run preview"

tools/scripts/release_workflow.js

@@ -115,6 +115,7 @@ function runReleaseSuite(projectRoot) {
   runCommand("npm", ["run", "validate:references"], projectRoot);
   runCommand("npm", ["run", "sync:release-state"], projectRoot);
   runCommand("npm", ["run", "test"], projectRoot);
+  runCommand("npm", ["run", "app:install"], projectRoot);
   runCommand("npm", ["run", "app:build"], projectRoot);
   runCommand("npm", ["pack", "--dry-run", "--json"], projectRoot);
 }

tools/scripts/tests/automation_workflows.test.js

@@ -12,6 +12,7 @@ const packageJson = JSON.parse(readText("package.json"));
 const generatedFiles = JSON.parse(readText("tools/config/generated-files.json"));
 const ciWorkflow = readText(".github/workflows/ci.yml");
 const publishWorkflow = readText(".github/workflows/publish-npm.yml");
+const releaseWorkflowScript = readText("tools/scripts/release_workflow.js");
 const hygieneWorkflowPath = path.join(repoRoot, ".github", "workflows", "repo-hygiene.yml");
 
 assert.ok(
@@ -50,6 +51,11 @@ assert.match(
   /check:warning-budget/,
   "sync:repo-state should enforce the frozen validation warning budget",
 );
+assert.strictEqual(
+  packageJson.scripts["app:install"],
+  "cd apps/web-app && npm ci",
+  "app:install should use npm ci for deterministic web-app installs",
+);
 
 for (const filePath of [
   "apps/web-app/public/sitemap.xml",
@@ -129,6 +135,11 @@ assert.match(
 );
 
 assert.match(publishWorkflow, /run: npm ci/, "npm publish workflow should install dependencies");
+assert.match(
+  publishWorkflow,
+  /run: npm run app:install/,
+  "npm publish workflow should install web-app dependencies before building",
+);
 assert.match(
   publishWorkflow,
   /run: npm run sync:release-state/,
@@ -141,6 +152,11 @@ assert.match(
 );
 assert.match(publishWorkflow, /run: npm run test/, "npm publish workflow should run tests before publish");
 assert.match(publishWorkflow, /run: npm run app:build/, "npm publish workflow should build the app before publish");
+assert.match(
+  releaseWorkflowScript,
+  /runCommand\("npm", \["run", "app:install"\], projectRoot\);[\s\S]*runCommand\("npm", \["run", "app:build"\], projectRoot\);/,
+  "release workflow should install web-app dependencies before building the app",
+);
 assert.match(
   publishWorkflow,
   /npm pack --dry-run --json/,