From 511987eb5586cd6d68677160adeffcc15c904901 Mon Sep 17 00:00:00 2001
From: Robert Vangor <robert.vangor@staffbase.com>
Date: Thu, 23 Jul 2026 15:24:23 +0200
Subject: [PATCH] ACT-3680: publish SDK 1.3.9 correctly

---
 .github/workflows/publish-npm.yml | 7 ++++++-
 package-lock.json                 | 4 ++--
 package.json                      | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 4479dda..ed79df6 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -19,7 +19,12 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
+
+      - name: Verify package version
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: test "$(node -p "require('./package.json').version")" = "$RELEASE_TAG"
 
       - name: Create build
         run: npm run build
diff --git a/package-lock.json b/package-lock.json
index c44d09a..330da7a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@staffbase/staffbase-plugin-sdk",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@staffbase/staffbase-plugin-sdk",
-      "version": "1.3.8",
+      "version": "1.3.9",
       "license": "ISC",
       "dependencies": {
         "jsonwebtoken": "^9.0.0",
diff --git a/package.json b/package.json
index 1bccedf..fddbf3a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@staffbase/staffbase-plugin-sdk",
-  "version": "1.3.8",
+  "version": "1.3.9",
   "description": "Staffbase Plugin SDK for Javascript / Node.js",
   "main": "./dist/index.js",
   "scripts": {