Fix "Publish to npm" CI failure: wire GITLEAKS_LICENSE and document missing NPM_TOKEN

[Copilot]

The "Publish to npm" job fails with ENEEDAUTH because NODE_AUTH_TOKEN resolves to empty, and the security-scan job fails because the gitleaks action runs without a license key (required for org repos).

Changes

• ci.yml — Wire GITLEAKS_LICENSE to the newly added GITLEAKS_KEY org secret:

  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_KEY }}
    GITLEAKS_CONFIG: .gitleaks.toml

Manual action required

The npm-publish.yml workflow is correctly configured — it references secrets.NPM_TOKEN as NODE_AUTH_TOKEN. The secret itself is missing from the repo/org. Add an npm automation token as NPM_TOKEN under Settings → Secrets and variables → Actions to unblock publishing.

[VrilLabs]

NPM_TOKEN changed to NPM_REGISTRY_TOKEN

[Copilot]

Pull request overview

Updates the CI workflow to unblock the security-scan job by providing the required gitleaks license key via Actions secrets, aligning with the org requirement for licensed gitleaks runs.

Changes:

• Wires GITLEAKS_LICENSE in .github/workflows/ci.yml to the GITLEAKS_KEY secret for the gitleaks action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.