ci(release): mirror npm publish to @shep.bot scope

[arielshad]

Summary

Mirrors every npm publish (dev prerelease + production stable release) to a second scope, @shep.bot/cli, alongside the canonical @shepai/cli. Fully additive and backward compatible — existing users keep installing @shepai/cli unchanged.

This is also a hedge against the current dev-release outage (the primary NPM_TOKEN was revoked sometime between 14:57 and 17:00 UTC on 2026-05-03, blocking all dev releases until rotated). With this PR, even when one token misbehaves, the other keeps publishing.

What changed

.github/workflows/ci.yml — purely additive (111 inserts, 0 deletes):

1. New parallel job dev-release-shepbot (PRs only)

   • Same needs: list as dev-release, runs in parallel.
   • Uses a separate secret NPM_TOKEN_SHEPBOT.
   • Swaps the package name in-job via npm pkg set name='@shep.bot/cli', then publishes with --tag dev.
   • continue-on-error: true at the job level — a misconfigured token cannot block PR merges.
   • Posts its own PR comment with comment-tag: dev-release-shepbot (independent from the existing @shepai comment).

2. Final mirror step in the existing release job (main pushes only)

   • Captures the pre-release version, runs semantic-release as today, then mirror-publishes if and only if the version actually bumped (so PRs that merge with no releasable changes do not re-publish).
   • continue-on-error: true — a failed mirror does not break the canonical @shepai/cli release.

Both publish paths guard against an unset NPM_TOKEN_SHEPBOT secret with a warning + clean exit, so the workflow does not break on first run before the secret is configured.

Required follow-up (not in this PR)

• On npmjs.com, generate a granular access token with publish access to the @shep.bot org.
• Add it to repo secrets as NPM_TOKEN_SHEPBOT.
• Separately, rotate NPM_TOKEN to fix the canonical @shepai/cli outage.

Test plan

• Open this PR — confirm the new Dev Release (shep.bot mirror) check appears and passes (or warns + exits cleanly if NPM_TOKEN_SHEPBOT is unset).
• Confirm the existing Dev Release check is unchanged.
• After merge to main, confirm the production Release job runs the new mirror step and either publishes @shep.bot/cli@<version> or warns + exits cleanly.

🤖 Generated with Claude Code

[github-actions]

Dev Release Published — @shep.bot mirror

Artifact	Version	Install
npm	1.198.0-pr598.41caa6d	npm install -g @shep.bot/cli@1.198.0-pr598.41caa6d

---

_{Mirror publish from commit f904b60 | View CI}