Each sequence gets its own workflow so the two version models never meet in one
file. Pack runs without credentials on every pull request and master push, so a
pull request proves the whole publish set still packs; publication is a manual
dispatch guarded by the npm-publish environment, runs only from that family's
tag, and never builds - it uploads the bytes pack produced.
imccyu
4e91230dd6