From bb98651ae713a741d29ce361f2b5909b1c3d7cff Mon Sep 17 00:00:00 2001
From: Mao Nakamoto <41178744+maonakamoto@users.noreply.github.com>
Date: Wed, 26 Aug 2026 15:06:52 +0200
Subject: [PATCH] fix(ci): a missing publish credential is not a failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This repo has no NPM_TOKEN, so the v0.3.0 tag built, verified, produced a
correct 27.7 kB tarball — and then failed on ENEEDAUTH. Left alone, every future
version tag does the same forever.

That is the expensive kind of red: an X that means "nothing is wrong, a secret
is absent". People learn to scroll past those, and the next thing they scroll
past is a real one. This fleet already has that scar written down.

So an absent token now SKIPS and says so in the job summary, including the
GitHub install line that does work. Everything that proves the release is real
still runs first — tag/version match, lint, typecheck, build, tests. Only the
push to the registry is conditional.

Add NPM_TOKEN and re-run the workflow and it publishes, with no change here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 46 ++++++++++++++++++++++++++++++++++-
 1 file changed, 45 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f78236a..c2e2d43 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -2,6 +2,11 @@ name: Publish
 
 # Publishing is driven by a version tag, so the released artifact is always
 # traceable to a commit. `npm version` creates the tag; pushing it ships.
+#
+# If no NPM_TOKEN is set, the tag is still built and verified and the run stays
+# GREEN — it reports that it skipped the registry. A workflow that goes red
+# because a secret is absent teaches everyone to ignore this workflow, and the
+# next thing it ignores will be a real failure.
 on:
   push:
     tags: ['v*']
@@ -37,6 +42,45 @@ jobs:
             exit 1
           fi
 
-      - run: npm publish
+      # Is there a credential to publish WITH?
+      #
+      # There is not, today, and pretending otherwise costs more than the
+      # missing release. Without this the job fails on every future version tag
+      # — a red X that means "nothing is wrong, a secret is absent", which is
+      # the most expensive kind of failure: the sort people learn to scroll
+      # past, right next to the real ones.
+      #
+      # So a missing token SKIPS and says so in the summary. The tag, the build
+      # and `verify` all still ran, so the release is real and reproducible; it
+      # just did not reach the public registry. Add NPM_TOKEN and re-run this
+      # workflow and it publishes with no further change.
+      - name: Is a registry credential available?
+        id: cred
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -n "${NPM_TOKEN:-}" ]; then
+            echo "have=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "have=false" >> "$GITHUB_OUTPUT"
+            {
+              echo '## Publish skipped'
+              echo
+              echo "Tag \`${GITHUB_REF_NAME}\` was built and verified, but no \`NPM_TOKEN\`"
+              echo 'secret is set on this repository, so it was not pushed to npm.'
+              echo
+              echo 'This is not a failure. The package installs from GitHub:'
+              echo
+              echo '```'
+              echo "npm i github:${GITHUB_REPOSITORY}#${GITHUB_REF_NAME}"
+              echo '```'
+              echo
+              echo 'To publish to npm instead, add the secret and re-run this workflow.'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Publish to npm
+        if: steps.cred.outputs.have == 'true'
+        run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}