fix(publish_release): add NODE_AUTH_TOKEN to Populate Release step

[saltenasl]

Release is now failing yarn install due to missing node auth token.

https://github.com/deepnote/jupyterlab-deepnote/actions/runs/18875005520/job/53862422778

Summary by CodeRabbit

• Chores
  • Updated internal build and release infrastructure for improved workflow reliability.

---

Note: This release contains only internal infrastructure improvements with no direct impact on user-facing functionality.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflow file .github/workflows/publish-release.yml is updated to add the NODE_AUTH_TOKEN environment variable to the Populate Release step. This variable is set to the value of GITHUB_TOKEN, exposing the authentication token to the populate-release action for use during the release publishing process.

Possibly related PRs

• fix(publish_release): add GITHUB_TOKEN to Populate Release step #54: Modifies the same workflow file and Populate Release step to expose GitHub authentication tokens for the release action.

Suggested reviewers

• dinohamzic

Pre-merge checks

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The PR title "fix(publish_release): add NODE_AUTH_TOKEN to Populate Release step" directly and accurately describes the main change in the changeset. The title is specific about what was added (NODE_AUTH_TOKEN), where it was added (Populate Release step), and the file affected is clear from context (.github/workflows/publish-release.yml). The language is concise, avoids vague terms, and uses a standard commit convention format that immediately conveys the purpose of the change.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between beef011 and 5364066.

📒 Files selected for processing (1)

• .github/workflows/publish-release.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build
• GitHub Check: check_release

🔇 Additional comments (1)

.github/workflows/publish-release.yml (1)

30-40: Verify authentication strategy and consistency.

The addition of NODE_AUTH_TOKEN set to GITHUB_TOKEN differs from the Finalize Release step (line 45), which uses NPM_TOKEN. Clarify whether populate-release intentionally uses GITHUB_TOKEN for npm authentication and whether this is appropriate for the target registry (GitHub Package Registry vs. public npm).

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.56%. Comparing base (beef011) to head (5364066).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #55   +/-   ##
=======================================
  Coverage   69.56%   69.56%           
=======================================
  Files          13       13           
  Lines         253      253           
  Branches       28       28           
=======================================
  Hits          176      176           
  Misses         73       73           
  Partials        4        4           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.