fix(release): use workflow package token (#186)

Author: lzehrung

.github/workflows/release.yml

@@ -50,9 +50,28 @@ jobs:
           )
           echo "$version" >> "$GITHUB_OUTPUT"
 
+  registry-auth-preflight:
+    name: Verify GitHub Packages authentication
+    needs: plan-release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup Node for GitHub Packages
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.10.0
+          registry-url: https://npm.pkg.github.com
+          scope: "@lzehrung"
+
+      - name: Authenticate with the workflow token
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm whoami --registry=https://npm.pkg.github.com
+
   build-native-artifacts:
     name: Build ${{ matrix.suffix }}
-    needs: plan-release
+    needs:
+      - plan-release
+      - registry-auth-preflight
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -727,7 +746,7 @@ jobs:
 
       - name: Publish only certified tarballs
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
           node ./scripts/certification/publish-release-candidates.mjs \

PUBLISHING.md

@@ -99,7 +99,7 @@ A structural result proves archive checksum, package identity, target naming, an
 
 Publishing waits for every required package row plus security, semantics, and hermeticity. Missing, failed, stale-revision, wrong-version, expired-exception, size, or checksum evidence stops the job before `npm publish` is invoked.
 
-The workflow uses `PACKAGE_PUBLISH_TOKEN` when configured and otherwise uses the workflow-scoped `GITHUB_TOKEN`. The job has `packages: write`; a custom token is only needed when the repository's workflow token cannot write an existing package.
+The workflow uses its repository-scoped `GITHUB_TOKEN` with `packages: write`; it does not prefer long-lived package secrets. A registry authentication preflight runs before native builds so invalid workflow access fails before the certification matrix starts.
 
 ## Package Roles
 

tests/certification-release-workflow.test.ts

@@ -16,12 +16,17 @@ function jobBlock(workflow: string, jobName: string): string {
 describe("certified release workflows", () => {
   it("finishes package certification and publication before standalone previews", () => {
     const assemble = jobBlock(releaseWorkflow, "assemble-release-candidates");
+    const authPreflight = jobBlock(releaseWorkflow, "registry-auth-preflight");
+    const buildNative = jobBlock(releaseWorkflow, "build-native-artifacts");
     const security = jobBlock(releaseWorkflow, "security-production");
     const smoke = jobBlock(releaseWorkflow, "package-smoke");
     const packageFunnel = jobBlock(releaseWorkflow, "package-funnel");
     const report = jobBlock(releaseWorkflow, "certification-report");
     const publish = jobBlock(releaseWorkflow, "publish-certified");
 
+    expect(authPreflight).toContain("npm whoami --registry=https://npm.pkg.github.com");
+    expect(authPreflight).toContain("NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}");
+    expect(buildNative).toContain("- registry-auth-preflight");
     expect(assemble).toContain("- build-native-artifacts");
     expect(security).toContain("- assemble-release-candidates");
     expect(smoke).toContain("- security-production");
@@ -56,7 +61,8 @@ describe("certified release workflows", () => {
     expect(releaseWorkflow.split("assemble-release-candidates.mjs")).toHaveLength(2);
     expect(releaseWorkflow).not.toContain("npm pack");
     expect(publish).toContain("publish-release-candidates.mjs");
-    expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN || secrets.GITHUB_TOKEN }}");
+    expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}");
+    expect(publish).not.toContain("PACKAGE_PUBLISH_TOKEN");
     expect(publish).not.toContain("CODEGRAPH_PACKAGES_TOKEN_B64");
     expect(publish).not.toContain("base64 --decode");
     expect(publish).toContain("temp/release-candidates/packages/*.tgz");