From 356804ee4c49b396a5250e8d722928852814b1f0 Mon Sep 17 00:00:00 2001
From: trapple <trapplejp@gmail.com>
Date: Tue, 28 Apr 2026 10:28:35 +0900
Subject: [PATCH] =?UTF-8?q?ci:=20NPM=5FTOKEN=E6=A4=9C=E8=A8=BC=E3=82=92?=
 =?UTF-8?q?=E5=86=92=E9=A0=AD=E3=81=AB=E8=BF=BD=E5=8A=A0=E3=81=97=E3=80=81?=
 =?UTF-8?q?publish=E3=82=92Release=E4=BD=9C=E6=88=90=E3=82=88=E3=82=8A?=
 =?UTF-8?q?=E5=85=88=E3=81=AB=E5=AE=9F=E8=A1=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

無効なNPM_TOKENで lint/build/test を全て走らせた末に publish で
失敗するムダ、および publish 失敗時に GitHub Release だけ先行作成されて
不整合状態になり再実行が困難になる問題を解消。

- Setup Node.js直後に npm whoami でトークンの有効性を検証し、
  無効ならその時点で fail させる
- npm publish が成功してから GitHub Release を作るよう順序を変更し、
  publish 失敗時に Release が残らないようにする
---
 .github/workflows/release.yml | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7efbc41..efe84ec 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,6 +28,17 @@ jobs:
           cache: 'npm'
           registry-url: 'https://registry.npmjs.org'
 
+      - name: Verify NPM_TOKEN
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          if [ -z "$NODE_AUTH_TOKEN" ]; then
+            echo "::error::NPM_TOKEN secret is not set"
+            exit 1
+          fi
+          # トークンの有効性を whoami で検証（無効なら 401 で非ゼロ終了）
+          npm whoami --registry=https://registry.npmjs.org/
+
       - name: Install dependencies
         run: npm ci
 
@@ -82,6 +93,11 @@ jobs:
             echo "v${VERSION} のリリース" > release_notes.md
           fi
 
+      - name: Publish to NPM
+        run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
@@ -97,11 +113,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Publish to NPM
-        run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Create release summary
         run: |
           echo "## Release Summary" >> $GITHUB_STEP_SUMMARY