fix(publish_release): add NODE_AUTH_TOKEN and GITHUB_TOKEN env vars to the job scope

[saltenasl]

jupyter_releaser call yarn in its sub-processes where the GITHUB_TOKEN and NODE_AUTH_TOKEN is no longer available. By moving the env var definition to job level we should fix the following error:
https://github.com/deepnote/jupyterlab-deepnote/actions/runs/18873254259/job/53859600292

Summary by CodeRabbit

• Chores
  • Updated release workflow configuration for improved environment variable management.

[coderabbitai]

📝 Walkthrough

Walkthrough

Environment variables GITHUB_TOKEN and NODE_AUTH_TOKEN are moved from the step level to the job level in the publish-release workflow. This makes them available to all steps within the publish_release job rather than just the Populate Release step.

Possibly related PRs

• fix(publish_release): add NODE_AUTH_TOKEN to Populate Release step #55: Modifies the same publish-release workflow's handling of GITHUB_TOKEN and NODE_AUTH_TOKEN environment variable placement.
• fix(publish_release): add GITHUB_TOKEN to Populate Release step #54: Changes the scope of GITHUB_TOKEN and NODE_AUTH_TOKEN in .github/workflows/publish-release.yml.

Suggested reviewers

• dinohamzic

Pre-merge checks

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title accurately describes the primary change: moving GITHUB_TOKEN and NODE_AUTH_TOKEN environment variables from the step level to the job scope in the publish_release workflow. It is specific and clear about both what was added and where, directly matching the changeset. A teammate scanning commit history would immediately understand the intent—fixing subprocess access to auth tokens by elevating variable scope.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 0a11e69 and 3f29552.

📒 Files selected for processing (1)

• .github/workflows/publish-release.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)

• GitHub Check: build
• GitHub Check: check_release

🔇 Additional comments (1)

.github/workflows/publish-release.yml (1)

21-23: Verify NODE_AUTH_TOKEN token reference.

Both GITHUB_TOKEN and NODE_AUTH_TOKEN reference ${{ secrets.GITHUB_TOKEN }}. This looks unusual—NODE_AUTH_TOKEN typically authenticates to npm registries and should generally use NPM_TOKEN or a dedicated npm secret. Line 45 shows NPM_TOKEN: ${{ secrets.NPM_TOKEN }} also exists in this workflow.

Confirm whether NODE_AUTH_TOKEN should map to secrets.GITHUB_TOKEN (e.g., for GitHub Packages as npm registry) or to secrets.NPM_TOKEN.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.56%. Comparing base (0a11e69) to head (3f29552).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #56   +/-   ##
=======================================
  Coverage   69.56%   69.56%           
=======================================
  Files          13       13           
  Lines         253      253           
  Branches       28       28           
=======================================
  Hits          176      176           
  Misses         73       73           
  Partials        4        4           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.