fix(release): restore package token fallback (#185)

Author: lzehrung

.github/workflows/release.yml

@@ -727,11 +727,9 @@ jobs:
 
       - name: Publish only certified tarballs
         env:
-          CODEGRAPH_PACKAGES_TOKEN_B64: ${{ secrets.CODEGRAPH_PACKAGES_TOKEN_B64 }}
+          NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
-          export NODE_AUTH_TOKEN="$(printf '%s' "$CODEGRAPH_PACKAGES_TOKEN_B64" | base64 --decode)"
-          echo "::add-mask::$NODE_AUTH_TOKEN"
           node ./scripts/certification/publish-release-candidates.mjs \
             --manifest temp/release-candidates/release-candidate-manifest.json \
             --expected-source-revision ${{ needs.plan-release.outputs.source_revision }} \

PUBLISHING.md

@@ -99,7 +99,7 @@ A structural result proves archive checksum, package identity, target naming, an
 
 Publishing waits for every required package row plus security, semantics, and hermeticity. Missing, failed, stale-revision, wrong-version, expired-exception, size, or checksum evidence stops the job before `npm publish` is invoked.
 
-The workflow uses the `CODEGRAPH_PACKAGES_TOKEN_B64` Actions secret, which must contain a base64-encoded classic PAT that can write the `@lzehrung` packages.
+The workflow uses `PACKAGE_PUBLISH_TOKEN` when configured and otherwise uses the workflow-scoped `GITHUB_TOKEN`. The job has `packages: write`; a custom token is only needed when the repository's workflow token cannot write an existing package.
 
 ## Package Roles
 

tests/certification-release-workflow.test.ts

@@ -56,8 +56,9 @@ describe("certified release workflows", () => {
     expect(releaseWorkflow.split("assemble-release-candidates.mjs")).toHaveLength(2);
     expect(releaseWorkflow).not.toContain("npm pack");
     expect(publish).toContain("publish-release-candidates.mjs");
-    expect(publish).toContain("CODEGRAPH_PACKAGES_TOKEN_B64: ${{ secrets.CODEGRAPH_PACKAGES_TOKEN_B64 }}");
-    expect(publish).toContain("base64 --decode");
+    expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}");
+    expect(publish).not.toContain("CODEGRAPH_PACKAGES_TOKEN_B64");
+    expect(publish).not.toContain("base64 --decode");
     expect(publish).toContain("temp/release-candidates/packages/*.tgz");
     expect(publish).toContain("temp/release-candidates/SHA256SUMS");
     expect(publish).toContain("release-candidate-manifest.json");