fix(release): align npm auth variables (#188)

Author: lzehrung

.github/workflows/release.yml

@@ -65,6 +65,7 @@ jobs:
       - name: Authenticate classic package token
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
         run: npm whoami --registry=https://npm.pkg.github.com
 
   build-native-artifacts:
@@ -747,6 +748,7 @@ jobs:
       - name: Publish only certified tarballs
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
         shell: bash
         run: |
           node ./scripts/certification/publish-release-candidates.mjs \

PUBLISHING.md

@@ -99,7 +99,7 @@ A structural result proves archive checksum, package identity, target naming, an
 
 Publishing waits for every required package row plus security, semantics, and hermeticity. Missing, failed, stale-revision, wrong-version, expired-exception, size, or checksum evidence stops the job before `npm publish` is invoked.
 
-The workflow uses the `PACKAGE_PUBLISH_TOKEN` Actions secret in both the registry preflight and publication job. It must contain a current classic personal access token with `read:packages` and `write:packages`; GitHub Packages does not support fine-grained personal access tokens for this purpose.
+The workflow exposes the `PACKAGE_PUBLISH_TOKEN` Actions secret as both `NODE_AUTH_TOKEN` for `actions/setup-node` and `GITHUB_TOKEN` for the repository `.npmrc` in the registry preflight and publication job. It must contain a current classic personal access token with `read:packages` and `write:packages`; GitHub Packages does not support fine-grained personal access tokens for this purpose.
 
 ## Package Roles
 

tests/certification-release-workflow.test.ts

@@ -26,6 +26,7 @@ describe("certified release workflows", () => {
 
     expect(authPreflight).toContain("npm whoami --registry=https://npm.pkg.github.com");
     expect(authPreflight).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
+    expect(authPreflight).toContain("GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
     expect(buildNative).toContain("- registry-auth-preflight");
     expect(assemble).toContain("- build-native-artifacts");
     expect(security).toContain("- assemble-release-candidates");
@@ -62,6 +63,7 @@ describe("certified release workflows", () => {
     expect(releaseWorkflow).not.toContain("npm pack");
     expect(publish).toContain("publish-release-candidates.mjs");
     expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
+    expect(publish).toContain("GITHUB_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
     expect(publish).not.toContain("CODEGRAPH_PACKAGES_TOKEN_B64");
     expect(publish).not.toContain("base64 --decode");
     expect(publish).toContain("temp/release-candidates/packages/*.tgz");