Do not publish to npm if no changes

.github/workflows/publish.yml

@@ -34,6 +34,6 @@ jobs:
         run: printf '%s\n' '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' registry=https://registry.npmjs.org/ always-auth=true >> .npmrc
       - name: Publish
         working-directory: ${{env.working-directory}}
-        run: npm publish --provenance --access public
+        run: ./scripts/publish-npm.sh
         env:
           NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

.gitignore

@@ -1,6 +1,8 @@
 # NPM libraries
 node_modules
 dist
+# Output of 'npm pack'
+*.tgz
 
 # Editor settings
 .vscode

js-library/scripts/publish-npm.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Reference: NPM RRFC --if-needed https://github.com/npm/rfcs/issues/466
+
+LOCAL_SHASUM=$(npm pack --json | jq '.[] | .shasum' | sed -r 's/^"|"$//g')
+
+NPM_TARBALL=$(npm show @dfinity/verifiable-credentials dist.tarball)
+NPM_SHASUM=$(curl -s "$NPM_TARBALL" 2>&1 | shasum | cut -f1 -d' ')
+
+if [ "$LOCAL_SHASUM" == "$NPM_SHASUM" ]; then
+  echo "No changes in @dfinity/verifiable-credentials need to be published to NPM."
+else
+  npm publish --provenance --access public
+fi