- Shipped
- September 9, 2026 at 11:48 PM UTC
- Author
- Kamo
- Commit
- 9df723b
The secret exists now — a Forgejo token scoped to `write:package`, added to this repository — so `publish_packages` does the publishing instead of a person doing it by hand. 0.1.1 is the first version CI builds and pushes; 0.1.0 was built locally, and an artifact whose provenance is "somebody's laptop" is not what a signing surface should be shipped from. Two things the first attempt got wrong, both now removed rather than worked around: - **The credential has to be a TOKEN, not an account password.** The registry rejects a password sent as `_authToken` with a bare 401 and nothing to say the scheme was the problem — which is what sent the previous attempt off chasing basic auth and a GIT_CLONE_TOKEN fallback that was never going to work either. A `write:package` token as a bearer publishes fine; the proof is that re-publishing an existing version with one answers 409 Conflict, not 401. - **The `npm whoami` health check was the wrong guard.** `whoami` needs `read:user`, which a publish token has no business holding, so the guard failed exactly the write-only credential it was meant to protect. There is no pre-flight now: a publish that cannot authenticate fails on its own, one line further down, with the registry's own error. kamo-internal is unaffected until somebody moves its lockfile: it asks for `^0.1.0` and its lockfile pins 0.1.0, so `npm ci` keeps installing what it already has.