ci(npm): fallback publish token for scoped packages

[rafaelscosta]

Context

The v5.2.8 publish workflow failed with npm 404 on PUT for @aiox-squads/core, @aiox-squads/installer and @aiox-squads/aiox-pro-cli. The workflow used only NPM_TOKEN_AIOX_SQUADS for scoped packages, while the legacy publish path already has fallback to NPM_TOKEN.

Change

• Try NPM_TOKEN_AIOX_SQUADS first for scoped packages.
• Fall back to NPM_TOKEN if the first token cannot publish.
• Keep the explicit failure message if neither token has owner access.

Validation

• git diff --check
• YAML parse with Ruby YAML.load_file

Summary by CodeRabbit

• Chores
  • Enhanced npm publishing workflow with improved retry logic using multiple authentication tokens, better error reporting, and automatic package access configuration for more reliable package releases.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aiox-core	Ready	Preview, Comment	May 21, 2026 12:40am

[coderabbitai]

Walkthrough

This PR hardens the npm publishing workflow by introducing a multi-token fallback mechanism for both the @aiox-squads/core package and workspace packages. The publish steps now iterate through available authentication tokens, handle failures gracefully with cleanup and detailed error reporting, and consistently manage npm package access visibility on success.

Changes

NPM Publishing Token Fallback

Layer / File(s)	Summary
Token fallback retry and error handling .github/workflows/npm-publish.yml	Core and workspace publishing steps now iterate through NPM_TOKEN_AIOX_SQUADS and NPM_TOKEN, write temporary .npmrc per token, track publish_status, clean up .npmrc on all paths, and on failure emit a detailed ::error:: message with package/scope name before exiting with the publish error code; on success, they set npm access to public and log the published version/tag.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• SynkraAI/aiox-core#707: Modifies npm registry authentication by using the NPM_TOKEN_AIOX_SQUADS secret for publishing/semantic-release, aligning with this PR's updated token-handling approach.
• SynkraAI/aiox-core#730: Also modifies .github/workflows/npm-publish.yml to implement npm publish token fallback with .npmrc handling and publish status tracking, though it additionally adds a legacy aiox-core publish job.
• SynkraAI/aiox-core#744: Modifies .github/workflows/npm-publish.yml to harden the npm publishing pipeline; while this PR adds token-rotated retries and .npmrc handling, that PR restructures publish sequencing and notification behavior.

Suggested labels

area: workflows, area: devops

Suggested reviewers

• Pedrovaleriolopez
• oalanicolas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci(npm): fallback publish token for scoped packages' directly and clearly describes the main change: adding a token fallback mechanism for NPM publishing of scoped packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/npm-publish-token-fallback

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📊 Coverage Report

Coverage report not available

📈 Full coverage report available in Codecov

---

Generated by PR Automation (Story 6.1)

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/npm-publish.yml (1)

212-212: 💤 Low value

Consider adopting npm trusted publishing (OIDC) for enhanced security.

The static analysis tool suggests using OIDC-based trusted publishing instead of long-lived tokens. This eliminates the need to manage NPM_TOKEN secrets and reduces the blast radius if tokens are compromised. npm supports this via the provenance flag combined with GitHub's OIDC provider.

This is not blocking for this PR since the current token-based approach is standard practice and the fallback logic is sound.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/npm-publish.yml at line 212, Update the publish step to
use GitHub OIDC trusted publishing: enable OIDC in the node setup (e.g., set
oidc: true in the npm/setup-node step) and change the publish command to add the
provenance flag (replace the current invocation "npm publish --tag ${{
steps.publish-tag.outputs.tag }} --access public" with "npm publish --tag ${{
steps.publish-tag.outputs.tag }} --access public --provenance"). Remove reliance
on the long-lived NPM_TOKEN secret (and any env: NPM_TOKEN usage) and ensure the
workflow requests the repository OIDC token via the setup-node configuration so
npm can perform provenance-based authenticated publish.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/npm-publish.yml:
- Line 212: Update the publish step to use GitHub OIDC trusted publishing:
enable OIDC in the node setup (e.g., set oidc: true in the npm/setup-node step)
and change the publish command to add the provenance flag (replace the current
invocation "npm publish --tag ${{ steps.publish-tag.outputs.tag }} --access
public" with "npm publish --tag ${{ steps.publish-tag.outputs.tag }} --access
public --provenance"). Remove reliance on the long-lived NPM_TOKEN secret (and
any env: NPM_TOKEN usage) and ensure the workflow requests the repository OIDC
token via the setup-node configuration so npm can perform provenance-based
authenticated publish.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 42fa868c-5ccc-47b3-b773-47cbc4042340

📥 Commits

Reviewing files that changed from the base of the PR and between 0abd64f and 44a1147.

📒 Files selected for processing (1)

• .github/workflows/npm-publish.yml

[github-actions]

🎉 This PR is included in version 5.3.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀