From 3443189af114003964a4275d11c631a70f55fe90 Mon Sep 17 00:00:00 2001
From: Slate Rehm <yehumbleaccounts@pm.me>
Date: Wed, 26 Aug 2026 19:40:58 -0500
Subject: [PATCH] (chore): migrate to infisical iac secrets

---
 .github/workflows/publish.yml | 12 ++++++------
 .npmrc                        |  1 -
 README.md                     | 12 ++----------
 package.json                  |  4 ++--
 4 files changed, 10 insertions(+), 19 deletions(-)
 delete mode 100644 .npmrc

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2300a1f..9783844 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,11 +12,11 @@ on:
 
 permissions:
   contents: read
-  packages: write
 
 jobs:
   publish:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    environment: production
     steps:
       - uses: actions/checkout@v7
         with:
@@ -26,24 +26,24 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
-          registry-url: https://npm.pkg.github.com
+          registry-url: https://registry.npmjs.org
           scope: "@bearfire-dev"
       - run: pnpm install --frozen-lockfile
       - run: pnpm check
       - if: github.event_name == 'release'
-        run: pnpm publish --no-git-checks
+        run: pnpm publish --no-git-checks --access public
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Verify published package
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_USERCONFIG: /dev/null
           PACKAGE_VERSION: ${{ inputs.version || github.event.release.tag_name }}
         working-directory: ${{ runner.temp }}
         run: |
           mkdir package-consumer
           cd package-consumer
           pnpm init
-          pnpm add --lockfile-only "@bearfire-dev/env@${PACKAGE_VERSION#v}"
+          pnpm add --lockfile-only --registry=https://registry.npmjs.org "@bearfire-dev/env@${PACKAGE_VERSION#v}"
       - name: Upload consumer lockfile
         uses: actions/upload-artifact@v6
         with:
diff --git a/.npmrc b/.npmrc
deleted file mode 100644
index fdc15cc..0000000
--- a/.npmrc
+++ /dev/null
@@ -1 +0,0 @@
-@bearfire-dev:registry=https://npm.pkg.github.com
diff --git a/README.md b/README.md
index 63c4b94..956c7e2 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,10 @@
 # @bearfire-dev/env
 
-This internal Bearfire package adds Bearfire defaults to [T3 Env](https://github.com/t3-oss/t3-env) and [Zod 4](https://zod.dev/).
+This Bearfire package adds Bearfire defaults to [T3 Env](https://github.com/t3-oss/t3-env) and [Zod 4](https://zod.dev/).
 
 It works with our [Infisical infrastructure-as-code system](https://github.com/bearfire-dev/infisical-iac). That system manages secret contracts and syncs secrets to application environments. This package validates those values at runtime and rejects Infisical placeholder values.
 
-This package is not intended or supported for external use.
+The package is publicly installable to avoid registry authentication. It is designed for Bearfire projects and has no external support commitment.
 
 ## Attribution
 
@@ -12,14 +12,6 @@ This package builds on [`@t3-oss/env-core`](https://github.com/t3-oss/t3-env) an
 
 ## Install
 
-Authenticate to GitHub Packages with `read:packages`, then install the package.
-
-Add the GitHub Packages registry to `.npmrc`:
-
-```ini
-@bearfire-dev:registry=https://npm.pkg.github.com
-```
-
 ```bash
 pnpm add @bearfire-dev/env @t3-oss/env-core zod
 ```
diff --git a/package.json b/package.json
index 45f2fb8..3fc2c59 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "@bearfire-dev/env",
-	"version": "0.1.0",
+	"version": "0.1.1",
 	"description": "Bearfire environment validation with T3 Env and Zod",
 	"type": "module",
 	"license": "MIT",
@@ -39,7 +39,7 @@
 	},
 	"publishConfig": {
 		"access": "public",
-		"registry": "https://npm.pkg.github.com"
+		"registry": "https://registry.npmjs.org"
 	},
 	"packageManager": "pnpm@10.33.4",
 	"engines": {