fix(release): use AIOX npm token for semantic release

[rafaelscosta]

Summary

• use the same NPM_TOKEN_AIOX_SQUADS secret in semantic-release that npm-publish already uses
• unblocks semantic-release dry-run before real publication

Validation

• git diff --check
• GitHub semantic-release dry-run failed before this change at npm whoami with secrets.NPM_TOKEN

Summary by CodeRabbit

• Chores
  • Updated authentication configuration for the automated release pipeline.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 8, 2026 7:14pm

[github-actions]

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

---

Generated by PR Automation (Story 6.1)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b51637dc-837b-4976-bb44-d0743967cf67

📥 Commits

Reviewing files that changed from the base of the PR and between 1d2ab55 and 2a7cf8f.

📒 Files selected for processing (1)

• .github/workflows/semantic-release.yml

---

Walkthrough

The semantic release workflow updates npm registry authentication across three steps by replacing the secrets.NPM_TOKEN secret reference with secrets.NPM_TOKEN_AIOX_SQUADS. Both NPM_TOKEN and NODE_AUTH_TOKEN environment variables now reference the new secret consistently in the verification, dry-run, and main release steps.

Changes

NPM Authentication Secret Migration

Layer / File(s)	Summary
Secrets Configuration Update .github/workflows/semantic-release.yml	npm auth verification, dry-run preview, and main semantic release steps update NPM_TOKEN and NODE_AUTH_TOKEN to use secrets.NPM_TOKEN_AIOX_SQUADS instead of secrets.NPM_TOKEN.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• Pedrovaleriolopez
• oalanicolas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: updating the semantic release workflow to use the AIOX npm token instead of the previous token.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/semantic-release-npm-token-20260508

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}