Report staged package ids from the publish output, not npm stage list

[antstanley]

The v0.3.3 release run reported ✅ success while its final step failed with npm error code E401 — Unable to authenticate and printed nothing. It was wrapped in || true, so it could not fail the job. The one step whose purpose is to tell you which packages to approve was silently dead.

It cannot work as written. actions/setup-node writes .npmrc with _authToken=${NODE_AUTH_TOKEN}, and this workflow ships no npm token by design — so that value is setup-node's placeholder (visible in the log as NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX). npm stage publish survives because npm swaps the Actions OIDC token for a short-lived credential, but that exchange only covers publish commands. A plain account-scoped read like npm stage list falls back to the placeholder and is rejected.

Handing it a token would give up the no-token property the whole workflow is built around ("No npm token anywhere"). Unnecessary anyway — the ids are already in hand, since npm stage publish prints + pkg@version (staged with id ...) per package. This tees that output and reads the ids back out, into both the step log and the job summary.

Also fails loudly now: the replacement runs under set -euo pipefail with no || true, so a future breakage surfaces instead of being swallowed.

Teed with 2>&1 so it does not depend on which stream npm uses — notices go to stderr and I did not want the capture betting on where the result line lands.

Verified against the real captured output of the v0.3.3 run:

• all three ids extracted (blogwright-core, blogwright-pds, blogwright);
• the decoy npm notice ... has been staged with tag latest line correctly not matched;
• the nothing-staged branch (re-run where every version is already published) exits 0 under set -euo pipefail rather than tripping on grep's exit code;
• the workflow YAML parses and the step list is as intended.

Note this is the release workflow, so it is only truly exercised by the next tag push. The shell was tested directly against captured output rather than by cutting a release.

No changeset: CI configuration, internal-only per DEVELOPMENT.md.

🤖 Generated with Claude Code