fix(ci): pass NODE_AUTH_TOKEN to npm publish step

[maatheusgois-dd]

Summary

• Fixes the npm publish job (Release workflow) which has failed with E404 Not Found for every run since v0.1.25 (Jun 6, 2026). npm on the registry is still at latest: 0.1.25 while the repo is at 0.1.27.
• Root cause: the Publish step runs npm publish --provenance --access public with no NODE_AUTH_TOKEN env. actions/setup-node with registry-url expects NODE_AUTH_TOKEN to authenticate the publish. Without it, npm attempts an anonymous PUT, which npm rejects with 404 Not Found (it hides existence of packages the caller can't publish to). Provenance signing still succeeds locally, then the PUT is rejected.

Change

• release.yml → add env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} to the Publish step.

Validation

• Workflow YAML inspected; edit applied to the Publish step only.
• CI run on this branch — will trigger on PR push.
• End-to-end publish — requires the NPM_TOKEN repo secret (see below).

Required action before merge

This fix references a NPM_TOKEN repository secret that must exist:

1. Create a Granular Access Token or Classic Automation/OAuth token on npm with publish rights to xcodebazelmcp.
   • Granular: scope Publish on package xcodebazelmcp, expiry as needed.
   • Classic: token type Automation (or Publish — avoid Legacy-only read tokens).
2. Add it as a repo (or environment) secret named NPM_TOKEN:
   GitHub → Settings → Secrets and variables → Actions → New repository secret → Name: NPM_TOKEN → paste token.
   (The publish job uses environment: npm, so adding it to the npm environment secrets also works and is tighter.)
3. If a token already exists under a different name (e.g. NPM_AUTH_TOKEN, NODE_AUTH_TOKEN), tell me and I'll switch the env reference to match — no need to create a new one.

After merge — publishing the missing versions

The repo is at 0.1.27 but npm latest is 0.1.25. Tags v0.1.26 and v0.1.27 were never pushed, so the on: push: tags: v* trigger never fired. After this PR merges and the token is set, either:

• Run the Release workflow manually: gh workflow run release.yml -f bump=patch (uses workflow_dispatch, which bumps/tags/publishes), or
• Push the missing tags: git push origin v0.1.26 v0.1.27 (triggers the tag-driven path). Note: re-checking out old tags republishes exactly those versions, so prefer the workflow_dispatch path to publish 0.1.28 (a fresh bump) instead.

I recommend workflow_dispatch with bump=patch → publishes a clean new version that includes this fix plus the merged hardening PR (#13).

Notes

• No code/CLI changes; workflow-only.
• The homebrew-tap and GitHub Release jobs depend on publish success, so they've been correctly skipping. They'll resume once publish is unblocked.

Co-authored-by: oh-my-pi https://omp.sh

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!