From f116d97223d5798140152bc37adf551056c5f46d Mon Sep 17 00:00:00 2001
From: TrueNine <truenine304520@gmail.com>
Date: Wed, 22 Apr 2026 13:48:03 +0800
Subject: [PATCH] ci: isolate npm auth from repo package metadata

---
 .github/workflows/release.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fe5bb4f4..ac53003d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -264,8 +264,13 @@ jobs:
             exit 1
           fi
 
+          tmp_dir="$(mktemp -d)"
+          trap 'rm -rf "$tmp_dir"' EXIT
+
+          pushd "$tmp_dir" >/dev/null
           npm config set //registry.npmjs.org/:_authToken "${NODE_AUTH_TOKEN}"
           npm whoami --registry "${NPM_REGISTRY_URL}"
+          popd >/dev/null
 
       - name: Download raw CLI binaries
         uses: actions/download-artifact@v8
@@ -335,8 +340,13 @@ jobs:
             exit 1
           fi
 
+          tmp_dir="$(mktemp -d)"
+          trap 'rm -rf "$tmp_dir"' EXIT
+
+          pushd "$tmp_dir" >/dev/null
           npm config set //registry.npmjs.org/:_authToken "${NODE_AUTH_TOKEN}"
           npm whoami --registry "${NPM_REGISTRY_URL}"
+          popd >/dev/null
 
       - name: Download raw MCP binaries
         uses: actions/download-artifact@v8