[WTF-2433]: Make widgets-tools publishing actions "trusted publishers" with npm (#150)

Fixes:
- Exported values must be on a single line. Added `-c` for compact
output to jq.
- Make the dependency on the discover job explicit

Since the release failed I needed to "unrelease" 11.3.0 again.

Author: weirdwater

.github/workflows/PublishNpm.yml

@@ -24,15 +24,19 @@ jobs:
               for tag in $(git tag --points-at HEAD); do
                 package=${tag%-v*}
                 version=${tag##*-v}
-                jq -nc --arg p $package --arg v $version '{ package: $p, version: $v }'
+                # Without a file argument, jq will wait for stdin, unless you specify --null-input.
+                # By default jq pretty prints json. We need all of it on 1 line, so we use --compact-output here.
+                jq --null-input --compact-output --arg p $package --arg v $version '{ package: $p, version: $v }'
               done
-            ) | jq --slurp '.'
+              # The github outputs don't support unescaped newlines. So we use compact output here as well.
+            ) | jq --compact-output --slurp '.'
           )" >> "$GITHUB_OUTPUT"
 
   publish:
     name: "Publish NPM packages"
     runs-on: ubuntu-latest
-
+    needs: discovery
+    if: ${{ needs.discover.outputs.releases != '[]' }}
     strategy:
       fail-fast: false
       matrix:

packages/pluggable-widgets-tools/CHANGELOG.md

@@ -6,8 +6,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
-## [11.3.0] - 2025-11-11
-
 ### Changed
 
 -   We added @d11/react-native-fast-image as an external native dependency in rollup config.