ci: exercise the release npmrc path on pull requests

[mariano-aguero]

What this changes

Passes registry-url to the setup-node step in ci.yml, so every pull request writes the same .npmrc the release job writes.

Why

release.yml is reached only by a push to main or a manual dispatch, so no pull request runs it. That matters whenever a change edits both workflows, which every Dependabot action bump does: #15, #19 and #20 each bump an action in ci.yml and in release.yml, and only the first half is under test when the PR goes green.

Comparing the two files, the release job's checkout and cache steps take the same inputs as CI's, and persist-credentials: true is the default anyway, so those run identically on every pull request. One input is not covered: setup-node in the release job also receives registry-url, which is what makes the action write an .npmrc pointing at the npm registry and reading NODE_AUTH_TOKEN. That file is what npm publish authenticates with, and no pull request has ever executed that path.

Passing the same input in CI runs that code and publishes nothing, since nothing in CI calls npm publish. A setup-node bump that changed how the file is written now fails on the pull request rather than on a release.

The alternative is to keep verifying that path by reading release notes, which is what was done for the open bumps: the only relevant breaking change across those majors is v5 starting to cache automatically when package.json declares packageManager, which this repository does not, so it neither activates nor collides with the existing bun cache step. That reading is worth less than a run.

How the new behaviour is pinned

• A published figure, transcribed rather than derived
• The golden byte vector or sig-hash from ethrex's frame_tx_wire_tests.rs
• Re-encoding captured chain data and reproducing the transaction hash
• A live receipt (recovered signer, maxCost, or the gasUsed decomposition)
• N/A, this change has no wire-format or gas behaviour

This PR's own CI run is the check: it exercises the step being added.

Load-bearing rules

• No
• Yes, and the argument for it is below

Checks

• bun run test
• bun run typecheck
• bun run build && bunx @arethetypeswrong/cli --pack . (required if exports, files, typesVersions or tsup.config.ts changed; otherwise N/A)
• bun run test:live (optional, hits the public endpoint, not a gate)

actionlint is clean on the edited file. The test and type checks were run on this branch and are unaffected, since the change is a workflow input.

Release impact

• No release (docs, chore, test, ci, refactor, style, perf, build)
• Patch (fix)
• Minor (feat)
• Major (feat! or a BREAKING CHANGE: footer)

AI assistance

• This change was written or reviewed with an assistant, and I have read every line of it

Related issues

N/A

[github-actions]

🎉 This PR is included in version 0.3.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀