[cryptotavares]

Description

Summary: Upgrade both npm publish steps to MetaMask/action-npm-publish@v7, as requested by the Core team. Remove the obsolete SKIP_PREPACK environment overrides.

Problem

The release workflow uses v6 for dry-run and production publishing. V7 sanitizes Yarn configuration and removes publish lifecycle hooks before packing.

Before: build dist → restore artifacts → action-npm-publish@v6 + SKIP_PREPACK
After:  build dist → restore artifacts → action-npm-publish@v7 sanitization

Changes

• Upgrade the dry-run and production action references from @v6 to @v7.
• Remove SKIP_PREPACK: true from both steps. V7 removes the prepack hook before packing.

flowchart TD
    A[Build dist] --> B[Upload release artifacts]
    B --> C[Restore artifacts for dry run]
    C --> D[Publish action v7 dry run]
    D --> E[Restore artifacts for production]
    E --> F[Publish action v7]

    classDef new fill:#fff3cd,stroke:#d39e00
    class D,F new

Loading

Yellow boxes are new.

What changes

Area	Before	After
Dry run and production	action-npm-publish@v6	action-npm-publish@v7
Publish lifecycle hooks	Workflow skips the build through SKIP_PREPACK	Action removes publish lifecycle hooks before packing
Yarn configuration during publish	Repository configuration can load	Action uses sanitized configuration and clears external Yarn settings
Dry-run report	Package comparison	Also includes SHA-1 checksum and SHA-512 integrity

Decisions for reviewers

Decision	Reason
Use the v7 major tag	Follows the workflow's existing action-version convention.
Keep the explicit build before publishing	V7 no longer runs prepack; restored dist must already contain the package output.
Remove the step-level prepack overrides	V7 strips the hook itself, so these overrides no longer control publishing.

V7 compatibility

• packageManager selects Yarn 4.16.0, meeting the action's minimum requirement.
• .yarnrc.yml already uses nodeLinker: node-modules.
• publishConfig.registry targets https://registry.npmjs.org/, accepted by v7's registry check.
• The build job creates dist and uploads it with node_modules/.yarn-state.yml. Both publish jobs restore those artifacts.
• Neither publish step depends on external YARN_* overrides.

Review guide

Read .github/workflows/publish-release.yml. Check both action references, the removed environment blocks, and artifact restoration before each publish.

Validation

• Review the v7.0.0 release notes and implementation changes against the current workflow.
• yarn install --immutable passes with Node 24.22.1 and Yarn 4.16.0.
• actionlint 1.7.12 passes for all workflows. The downloaded release archive matches its published checksum.
• yarn oxfmt --check .github/workflows/publish-release.yml passes.
• yarn build passes.
• Built-package ATTW analysis confirms included types and zero problems.
• git diff --check passes.

Live publishing runs only through the release workflow; local validation does not exercise npm OIDC or staged publishing.

References

• Core team upgrade request.
• action-npm-publish v7.0.0 release notes
• V7 configuration and lifecycle sanitization
• V7 Yarn environment handling

Checklist

• Workflow validation and package build checks pass.
• Changelog changes omitted, consistent with the requested PR convention.