From 78f5e8f24b56475f6091f3944bd3de7aad8f03e7 Mon Sep 17 00:00:00 2001 From: Eli Robinson Date: Fri, 4 Sep 2026 21:45:39 -0700 Subject: [PATCH 1/2] ci: authenticate the release workflow to GitHub Packages MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release.yml installs dependencies too, and it never got the credential step that ci.yml did — so the first push to main after the modernize merge failed on the same 401 that CI had already been fixed for. CI was green on the PR because the release workflow only runs on push to main. Also backports the empty-token guard to ci.yml so both workflows fail with the command to run rather than a registry error that names neither the secret nor the repo. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 22 ++++++++++++++++------ .github/workflows/release.yml | 17 +++++++++++++++++ 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index efac1ed..0090f7a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,9 +27,14 @@ jobs: # output and still never reaches the request, which fails as a 401 saying # no authorization header was set. - name: Authenticate to GitHub Packages - run: pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" - env: - NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} + run: | + if [ -z "$NODE_AUTH_TOKEN" ]; then + echo "::error::NODE_AUTH_TOKEN is empty. Set it with:" \ + "gh secret set NODE_AUTH_TOKEN --repo ${{ github.repository }}" \ + "(a GitHub token with read:packages)." + exit 1 + fi + pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" - name: Install dependencies run: pnpm install --frozen-lockfile @@ -65,9 +70,14 @@ jobs: # output and still never reaches the request, which fails as a 401 saying # no authorization header was set. - name: Authenticate to GitHub Packages - run: pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" - env: - NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} + run: | + if [ -z "$NODE_AUTH_TOKEN" ]; then + echo "::error::NODE_AUTH_TOKEN is empty. Set it with:" \ + "gh secret set NODE_AUTH_TOKEN --repo ${{ github.repository }}" \ + "(a GitHub token with read:packages)." + exit 1 + fi + pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" - run: pnpm install --frozen-lockfile - name: Install Playwright browsers diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b07217..ffe5bff 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -24,6 +24,23 @@ jobs: node-version-file: ".nvmrc" cache: "pnpm" + # @elirobinson/tokens comes from GitHub Packages, which the runner has no + # credential for by default. `pnpm config set`, not an echo into ~/.npmrc: + # pnpm 11 keeps its own credential store and only sends tokens from there. + # The length check is because an empty secret produces the same 401 as a + # missing one, and the registry error names neither the secret nor the repo. + - name: Authenticate to GitHub Packages + run: | + if [ -z "$NODE_AUTH_TOKEN" ]; then + echo "::error::NODE_AUTH_TOKEN is empty. Set it with:" \ + "gh secret set NODE_AUTH_TOKEN --repo ${{ github.repository }}" \ + "(a GitHub token with read:packages)." + exit 1 + fi + pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" + env: + NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} + - name: Install dependencies run: pnpm install --frozen-lockfile From aad2fddb9af75731b00ec39f2ae82c93c0ae18ba Mon Sep 17 00:00:00 2001 From: Eli Robinson Date: Fri, 4 Sep 2026 21:47:01 -0700 Subject: [PATCH 2/2] fix(ci): restore the env binding the guard commit dropped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adding the empty-token guard to ci.yml replaced the whole step, `env:` block included, so NODE_AUTH_TOKEN was never passed to the shell. The guard then did exactly what it should and reported the secret as empty — the secret is fine; the step could not see it. Both files now have one env binding per authenticate step, checked rather than eyeballed. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0090f7a..3dd20cc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -35,6 +35,8 @@ jobs: exit 1 fi pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" + env: + NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} - name: Install dependencies run: pnpm install --frozen-lockfile @@ -78,6 +80,8 @@ jobs: exit 1 fi pnpm config set //npm.pkg.github.com/:_authToken "$NODE_AUTH_TOKEN" + env: + NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }} - run: pnpm install --frozen-lockfile - name: Install Playwright browsers