fix(release): restore npm publish auth checks

[pitzcarraldo]

Summary

Restore npm token authentication in the release workflow and make npm publish failures fail the run.

Details

The v1.1.3 release workflow created GitHub binary assets, but npm publish failed with E404 and the failure was hidden by tee. This PR keeps provenance enabled, restores NODE_AUTH_TOKEN from secrets.NPM_TOKEN, adds pipefail, and makes the npm tarball checksum download fail on HTTP errors.

Related Issues

N/A

How to Validate

1. Run bun run check && bun test
2. Run bun run build && bun test tests/e2e/
3. Confirm .github/workflows/release.yml sets NODE_AUTH_TOKEN for npm publish
4. Confirm .github/workflows/release.yml uses set -o pipefail before npm publish | tee
5. Confirm the SHA256 step uses curl --fail for the npm tarball

Pre-Merge Checklist

Code Quality

• Code builds without errors (bun run build)
• Types check correctly (bun run typecheck)
• Linter passes (bun run lint)
• Tests pass (bun test)
• Added/updated tests for new functionality (if applicable)

Documentation

• Updated relevant documentation (if needed)
• Updated CLAUDE.md if architecture changed (if needed)

Commit Standards

• Commits follow Conventional Commits format
• No breaking changes, OR breaking changes are documented

Platform Validation

• macOS
• Linux

[coderabbitai]

Walkthrough

The release workflow updates the publish-npm job to propagate pipeline failures during npm publish and to make tarball download errors explicit before SHA256 calculation.

Changes

Release Workflow Error Handling

Layer / File(s)	Summary
Pipefail and curl failure flags .github/workflows/release.yml	set -o pipefail is enabled before the `npm publish ...

Sequence Diagram(s)

Not applicable — the change is limited to shell flag updates in a CI workflow.

Estimated code review effort: 1 (~5 minutes)

Related issues: None provided.

Related PRs: None provided.

Suggested labels: ci, chore

Suggested reviewers: None provided.

🐰 Publish now fails when pipes fail,
Curl shows errors, no silent veil,
SHA256 waits on a clearer stream,
Release steps hardened, crisp and clean.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title is related to the release workflow fix, but it emphasizes auth checks more than the main hidden publish failure fix.
Description check	✅ Passed	The description matches the template with Summary, Details, Related Issues, How to Validate, and checklist sections mostly filled out.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-npm-publish-check

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/release.yml (2)

205-205: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Consider passing NPM_TAG via env: to silence the template-injection hint.

zizmor flags direct ${{ steps.npm_tag.outputs.tag }} interpolation into the shell script at Line 205. The value is workflow-derived (fixed to beta/alpha/rc/latest) so exploitability is low here, but routing it through env: is a cheap way to close the finding and follow GitHub's hardening guidance for run: blocks.

🔧 Suggested refactor

       - name: Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TAG: ${{ steps.npm_tag.outputs.tag }}
         run: |
           set -o pipefail
-          npm publish --provenance --access public --tag ${{ steps.npm_tag.outputs.tag }} 2>&1 | tee npm-publish.log || {
+          npm publish --provenance --access public --tag "$NPM_TAG" 2>&1 | tee npm-publish.log || {
             if grep -q "You cannot publish over the previously published versions" npm-publish.log; then
               echo "Version already published, skipping..."
             else
               exit 1
             fi
           }
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Also applies to: 213-213

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 205, Move the npm dist-tag value out
of direct shell interpolation in the release workflow: in the publish step(s)
that use npm publish, pass the tag from steps.npm_tag.outputs.tag through env as
NPM_TAG and reference that variable in the run block instead of embedding the
expression directly. Apply the same change to both publish commands so the
workflow uses a shell variable rather than template interpolation.

Source: Linters/SAST tools

---

219-221: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Optional: pass VERSION via env: to address the second template-injection hint.

Same pattern as Line 205 — zizmor flags Line 219's inline ${{ needs.check-version.outputs.current }}. Low risk given the value's provenance, but worth aligning with the env: approach for consistency and to clear the static-analysis finding.

🔧 Suggested refactor

       - name: Calculate SHA256
         id: sha256
+        env:
+          VERSION: ${{ needs.check-version.outputs.current }}
         run: |
           sleep 10
-          VERSION="${{ needs.check-version.outputs.current }}"
           TARBALL_URL="https://registry.npmjs.org/@clix-so/clix-cli/-/clix-cli-${VERSION}.tgz"
           curl --fail --silent --show-error --location "$TARBALL_URL" -o package.tgz

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 219 - 221, The release workflow
step is using an inline GitHub expression to populate VERSION, which triggers
the template-injection finding and is inconsistent with the safer pattern used
earlier in the workflow. Move the current version value from
needs.check-version.outputs.current into env: for this step, then reference that
environment variable when building TARBALL_URL and downloading the tarball,
keeping the behavior unchanged while removing the inline expression from the
shell block.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/release.yml:
- Line 205: Move the npm dist-tag value out of direct shell interpolation in the
release workflow: in the publish step(s) that use npm publish, pass the tag from
steps.npm_tag.outputs.tag through env as NPM_TAG and reference that variable in
the run block instead of embedding the expression directly. Apply the same
change to both publish commands so the workflow uses a shell variable rather
than template interpolation.
- Around line 219-221: The release workflow step is using an inline GitHub
expression to populate VERSION, which triggers the template-injection finding
and is inconsistent with the safer pattern used earlier in the workflow. Move
the current version value from needs.check-version.outputs.current into env: for
this step, then reference that environment variable when building TARBALL_URL
and downloading the tarball, keeping the behavior unchanged while removing the
inline expression from the shell block.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c187f59e-27c3-4750-a127-f135eb7c5ce3

📥 Commits

Reviewing files that changed from the base of the PR and between 285d249 and ab3ade9.

📒 Files selected for processing (1)

• .github/workflows/release.yml