diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 594c930..b88681d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,15 +1,3 @@
-name: Publish to npm
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  id-token: write
-
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -18,27 +6,33 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      # Sets up Node.js and configures the npm registry auth (OIDC trusted publisher exchange).
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
 
+      - name: Check if version is already published
+        id: version-check
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+
+          if npm view "export-codebase@$VERSION" version >/dev/null 2>&1; then
+            echo "Version $VERSION is already published. Skipping."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Version $VERSION is not published. Continuing."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install dependencies
+        if: steps.version-check.outputs.should_publish == 'true'
         run: npm ci
 
       - name: Build
+        if: steps.version-check.outputs.should_publish == 'true'
         run: npm run build
 
-      - name: Skip if version already published
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          if npm view export-codebase@$VERSION version >/dev/null 2>&1; then
-            echo "Version $VERSION already published — skipping."
-            exit 0
-          fi
-
-      # Trusted publisher (OIDC) — no NODE_AUTH_TOKEN needed.
       - name: Publish
+        if: steps.version-check.outputs.should_publish == 'true'
         run: npm publish --provenance