NEW @W-23810824@ - Add publish-to-npm-lite workflow for code-analyzer-lite beta

[aruntyagiTutu]

Summary

@W-23810824 - To release CA lite beta

• Adds .github/workflows/publish-to-npm-lite.yml, a dedicated npm-publish pipeline for the new @salesforce/plugin-code-analyzer-lite package (a trimmed CLI variant without the flow, sfge, and apexguru engines), being developed on the codeanalyzer-lite branch.
• This workflow file only needs to exist on dev because GitHub Actions requires release/workflow_dispatch workflow definitions to live on the default branch to be triggerable — the actual lite package source stays on codeanalyzer-lite and is not being merged here.
• No other files change. The workflow checks out the release tag itself (v5.0.0-beta.0 for the first release) to build/publish, independent of what's on dev.

Test plan

• Confirm sf-release npm:package:release succeeds against a codeanalyzer-lite tag once this merges
• Dispatch manually via workflow_dispatch with tag: v5.0.0-beta.0 to verify the full RC → smoke-test → promote pipeline
• Confirm published package resolves to @salesforce/plugin-code-analyzer-lite@5.0.0-beta.0 on npm

[nikhil-mittal-165]

Review — NEW @W-23810824@ Add publish-to-npm-lite workflow

Reviewed against the Code Analyzer team's PR standards. I diffed the new publish-to-npm-lite.yml line-by-line against the existing publish-to-npm.yml it was cloned from — that comparison drives most of the notes below. Overall this is a solid, safe workflow that actually improves on its template. Non-blocking; one thing worth settling before merge.

🔴 Worth resolving before merge — both workflows fire on every release

Both publish-to-npm.yml and the new publish-to-npm-lite.yml live on dev (the default branch) and both trigger on release: types: [released]. GitHub runs every matching workflow from the default branch, so each GitHub release will start both pipelines. Tracing the "wrong" one:

• Full-plugin release → lite's verify-candidate-tag fails at "Verify package name" (exit 1, name isn't -lite) → a red ❌ run on every full release.
• Lite release → the full workflow's "Fail non-matching commits" gate trips (tag commit ≠ main HEAD) → another failed run.

Nothing gets mis-published (each pipeline guards itself correctly), but every release accrues a spurious failed workflow run, which can read as "the release broke" to a release manager. Options:

• Keep lite on workflow_dispatch: only until it has its own release cadence, or
• Add a job-level if: guard so each workflow no-ops for the other's tags, or
• Document that the cross-failures are expected.

(Flagging as high-confidence-by-inspection — I can't exercise Actions from here.)

🟢 Nice — this version is more secure than the original

• "Compare tag to package.json" passes the tag via env: GIT_TAG instead of interpolating ${{ ... }} straight into the shell — closes a tag-name shell-injection vector, with a comment explaining why. 👍
• promote-to-latest does the same for NPM_TOKEN/GIT_TAG rather than inlining the secret into run:.

Suggest a follow-up to backport both hardenings to publish-to-npm.yml, which still uses the unsafe direct interpolation.

🟡 Non-blocking notes

1. Provenance: lite intentionally drops the "tag commit must match main" gate (correct — it releases from a tag). Its guards are package-name + major-version + tag==version, with no check that the tag originates from codeanalyzer-lite. Fine for beta; noting as accepted defense-in-depth debt.
2. Java 11 pin matches our compatibility rule. ✅
3. Smoke tests: rc-test runs the tag's own smoke-tests/smoke-test.*. Since the lite package drops flow/sfge/apexguru, please confirm those scripts on codeanalyzer-lite don't assert on the removed engines, or the RC gate will fail — worth adding to the test plan.
4. PR hygiene ✅ — one concern, one file, correct NEW @W-…@ convention, description accurately explains the "why on dev" reasoning.

Bottom line: LGTM in substance. Not a hard blocker — I'd just settle the dual-trigger-on-release behavior before merging, and open a follow-up to backport the injection fixes.

_{🤖 Generated with Claude Code using the Code Analyzer PR review standards.}