From b7350888b566cb0036cf9404f522bc4f887ecc9d Mon Sep 17 00:00:00 2001 From: Kuba Adamczyk Date: Mon, 26 Jan 2026 10:14:15 +0100 Subject: [PATCH] fix publishing --- .github/workflows/release.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c3c3b1fc3f..e6692ec893 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,6 +20,7 @@ jobs: env: # Force npm to emit provenance (SLSA) when publishing via OIDC. NPM_CONFIG_PROVENANCE: true + NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOT }} steps: - name: Checkout Repo @@ -33,7 +34,7 @@ jobs: with: node-version: 20.x registry-url: "https://registry.npmjs.org" - token: "" + token: ${{ secrets.NPM_PUBLISH_TOKEN_PHANTOM_SECURITY_BOT }} - name: Ensure npm 11.5.1+ for trusted publishing run: npm install -g npm@^11.5.1 @@ -48,7 +49,4 @@ jobs: # This expects you to have a script called release which does a build for your packages and calls changeset publish publish: yarn release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # we use trusted publishing and setup-node will set these incorrectly. Unset if we ever use RO_TOKEN - NODE_AUTH_TOKEN: "" - NPM_TOKEN: "" + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file