fix(ci): remove secrets from workflow if conditions

Gate npm/winget publish steps via runtime outputs so GitHub can parse and run the release workflow.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: joohw

.github/workflows/release-switcher.yml

@@ -40,65 +40,89 @@ jobs:
           version: "~> v2"
           install-only: true
 
-      - name: GoReleaser (release + brew)
-        if: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN != '' }}
+      - name: GoReleaser release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN }}
-        run: goreleaser release --clean --config .goreleaser.yaml
-
-      - name: GoReleaser (release only, skip brew)
-        if: ${{ secrets.HOMEBREW_TAP_GITHUB_TOKEN == '' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: goreleaser release --clean --config .goreleaser.yaml --skip=brew
+        run: |
+          if [ -n "$HOMEBREW_TAP_GITHUB_TOKEN" ]; then
+            goreleaser release --clean --config .goreleaser.yaml
+          else
+            goreleaser release --clean --config .goreleaser.yaml --skip=brew
+          fi
 
   npm:
     runs-on: ubuntu-latest
     needs: goreleaser
-    if: ${{ secrets.NPM_TOKEN != '' }}
+    if: ${{ startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' }}
     defaults:
       run:
         working-directory: switcher/npm
     steps:
+      - name: Decide npm publish
+        id: npm_gate
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -n "$NPM_TOKEN" ]; then
+            echo "publish=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "publish=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Checkout
+        if: ${{ steps.npm_gate.outputs.publish == 'true' }}
         uses: actions/checkout@v4
 
       - name: Setup Node
+        if: ${{ steps.npm_gate.outputs.publish == 'true' }}
         uses: actions/setup-node@v4
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
 
       - name: Sync package version from tag
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        if: ${{ steps.npm_gate.outputs.publish == 'true' && startsWith(github.ref, 'refs/tags/v') }}
         run: npm version "${GITHUB_REF_NAME#v}" --no-git-tag-version
 
       - name: Sync package version from input
-        if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version != '' }}
+        if: ${{ steps.npm_gate.outputs.publish == 'true' && github.event_name == 'workflow_dispatch' && github.event.inputs.version != '' }}
         run: npm version "${{ github.event.inputs.version }}" --no-git-tag-version
 
       - name: Publish npm package
+        if: ${{ steps.npm_gate.outputs.publish == 'true' }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: npm publish --access public
 
   winget:
     runs-on: windows-latest
     needs: goreleaser
-    if: ${{ startsWith(github.ref, 'refs/tags/v') && secrets.WINGET_CREATE_TOKEN != '' }}
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     defaults:
       run:
         shell: pwsh
         working-directory: switcher/packaging/winget
     steps:
+      - name: Decide winget submit
+        id: winget_gate
+        run: |
+          if ([string]::IsNullOrWhiteSpace("${{ secrets.WINGET_CREATE_TOKEN }}")) {
+            "submit=false" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+          } else {
+            "submit=true" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+          }
+
       - name: Checkout
+        if: ${{ steps.winget_gate.outputs.submit == 'true' }}
         uses: actions/checkout@v4
 
       - name: Install wingetcreate
+        if: ${{ steps.winget_gate.outputs.submit == 'true' }}
         run: winget install --id Microsoft.WingetCreate --source winget --accept-source-agreements --accept-package-agreements
 
       - name: Submit winget update PR
+        if: ${{ steps.winget_gate.outputs.submit == 'true' }}
         env:
           WINGET_CREATE_TOKEN: ${{ secrets.WINGET_CREATE_TOKEN }}
         run: |