Release workflow npm auth — npm.pkg.github.com 401 on @gocodealone/workflow-ui fetch

[intel352]

Observation

.github/workflows/release.yml Build-and-Release / Build-admin-UI step fails on npm ci against the private GitHub Packages npm registry. Captured on the v1.0.1 release run (post-cloud-SDK pin sweep — see https://github.com/GoCodeAlone/workflow/blob/main/docs/plans/2026-05-16-post-cloud-sdk-plugin-sweep.md):

Build and Release / Build admin UI:
  Cloning into '/tmp/workflow-ui-build'... ok
  npm error code E401
  npm error 401 Unauthorized - GET https://npm.pkg.github.com/download/@gocodealone/workflow-ui/0.2.0/...
    — authentication token not provided
  cp: cannot stat '/tmp/workflow-ui-build/ui/dist': No such file or directory
  ##[error]Process completed with exit code 1.

.npmrc or NODE_AUTH_TOKEN env wiring is missing for the Release workflow's UI build step. The Test workflow may not exercise this path so the gap survived earlier merges.

Impact

• v1.0.1 tag pushed on origin (9080b40); module-consumer path (go get github.com/GoCodeAlone/workflow-plugin-admin@v1.0.1) resolves via Go proxy reading the git tag directly.
• GitHub release / operator-facing wfctl plugin install resolves nothing — no release exists past v1.0.0.
• Operator-facing gap only — explicitly designated as advisory (NOT a CI gate) in the sweep design.

Remediation options

1. Add NODE_AUTH_TOKEN env wiring to the Build-admin-UI step:

   - name: Build admin UI
     env:
       NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     run: |
       echo "//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}" > /tmp/workflow-ui-build/ui/.npmrc
       cd /tmp/workflow-ui-build/ui && npm ci && npx vite build
       ...

   (GITHUB_TOKEN typically has packages:read for npm.pkg.github.com.)

2. Switch @gocodealone/workflow-ui to public-npm visibility if it doesn't need to stay private.

3. Vendor the workflow-ui dist into this repo so the Release step has no external npm fetch.

Followup release

After the fix, cut v1.0.2 to re-trigger GoReleaser against the merged main HEAD (the pin-bump commit). The bump itself ships in v1.0.1's tag; v1.0.2 would be a chore release that only republishes assets.

References

• Sweep plan: https://github.com/GoCodeAlone/workflow/blob/main/docs/plans/2026-05-16-post-cloud-sdk-plugin-sweep.md
• Sweep tracker: Plugin compatibility sweep at workflow v0.52.x (post-#617 godo removal) workflow#656
• v1.0.1 merge: this repo PR chore: bump workflow pin v0.51.7 → v0.53.1; release v1.0.1 #12 (squash-merge sha 9080b40)
• Failed Release run: gh run list --repo GoCodeAlone/workflow-plugin-admin --workflow Release first entry tagged v1.0.1