From 7de0edb6d7d3bfa69f0c8c483ecfba2106838857 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 6 Oct 2026 16:24:51 +0800
Subject: [PATCH] fix(publish): pass the org NPM_AUTH_TOKEN to npm publish

Org secrets only reach a job when the workflow references them. publish.yml
never did, so npm received setup-node's placeholder token and the v1.2.0
publish was rejected with E404 on PUT. Matches fleetbase-js and fleetops.
---
 .github/workflows/publish.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f868dc3..a7d4da2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -48,6 +48,7 @@ jobs:
                   sha256sum artifacts/*.tgz > artifacts/SHA256SUMS
             - name: Publish the verified bytes with provenance
               env:
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
                   RELEASE_TAG: ${{ github.ref_name }}
               run: |
                   version="${RELEASE_TAG#v}"