fix(release): require classic package token (#187)

Author: lzehrung

.github/workflows/release.yml

@@ -51,7 +51,7 @@ jobs:
           echo "$version" >> "$GITHUB_OUTPUT"
 
   registry-auth-preflight:
-    name: Verify GitHub Packages authentication
+    name: Verify classic package token
     needs: plan-release
     runs-on: ubuntu-latest
     steps:
@@ -62,9 +62,9 @@ jobs:
           registry-url: https://npm.pkg.github.com
           scope: "@lzehrung"
 
-      - name: Authenticate with the workflow token
+      - name: Authenticate classic package token
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
         run: npm whoami --registry=https://npm.pkg.github.com
 
   build-native-artifacts:
@@ -746,7 +746,7 @@ jobs:
 
       - name: Publish only certified tarballs
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}
         shell: bash
         run: |
           node ./scripts/certification/publish-release-candidates.mjs \

PUBLISHING.md

@@ -99,7 +99,7 @@ A structural result proves archive checksum, package identity, target naming, an
 
 Publishing waits for every required package row plus security, semantics, and hermeticity. Missing, failed, stale-revision, wrong-version, expired-exception, size, or checksum evidence stops the job before `npm publish` is invoked.
 
-The workflow uses its repository-scoped `GITHUB_TOKEN` with `packages: write`; it does not prefer long-lived package secrets. A registry authentication preflight runs before native builds so invalid workflow access fails before the certification matrix starts.
+The workflow uses the `PACKAGE_PUBLISH_TOKEN` Actions secret in both the registry preflight and publication job. It must contain a current classic personal access token with `read:packages` and `write:packages`; GitHub Packages does not support fine-grained personal access tokens for this purpose.
 
 ## Package Roles
 

tests/certification-release-workflow.test.ts

@@ -25,7 +25,7 @@ describe("certified release workflows", () => {
     const publish = jobBlock(releaseWorkflow, "publish-certified");
 
     expect(authPreflight).toContain("npm whoami --registry=https://npm.pkg.github.com");
-    expect(authPreflight).toContain("NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}");
+    expect(authPreflight).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
     expect(buildNative).toContain("- registry-auth-preflight");
     expect(assemble).toContain("- build-native-artifacts");
     expect(security).toContain("- assemble-release-candidates");
@@ -61,8 +61,7 @@ describe("certified release workflows", () => {
     expect(releaseWorkflow.split("assemble-release-candidates.mjs")).toHaveLength(2);
     expect(releaseWorkflow).not.toContain("npm pack");
     expect(publish).toContain("publish-release-candidates.mjs");
-    expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}");
-    expect(publish).not.toContain("PACKAGE_PUBLISH_TOKEN");
+    expect(publish).toContain("NODE_AUTH_TOKEN: ${{ secrets.PACKAGE_PUBLISH_TOKEN }}");
     expect(publish).not.toContain("CODEGRAPH_PACKAGES_TOKEN_B64");
     expect(publish).not.toContain("base64 --decode");
     expect(publish).toContain("temp/release-candidates/packages/*.tgz");