ci(publish): use NPM_TOKEN for the @next-alignment step

[jobordu]

OIDC trusted publishing authorizes 'npm publish' but not 'npm dist-tag add' — the dist-tag step runs as no-auth and silently fails with E401. The release therefore lands with @latest=0.44.2 and @next stuck at the previous version, breaking the documented '@next == @latest' invariant in CLAUDE.md.

This fix pipes the legacy NPM_TOKEN (already in GitHub repo secrets, created 2026-02-21) through env on the dist-tag step ONLY. 'npm publish' still uses OIDC. The token's dist-tag scope is the package (no IP allowlist needed for that scope), and the workflow falls back gracefully if the token is revoked/expired.

For 0.44.2 (the released PR #376), the NPM_TOKEN secret may itself be stale — user must regenerate on npmjs.com and re-add @next manually if needed.

For all future releases, this PR auto-aligns @next with @latest as part of the publish.yml pipeline.

Summary by CodeRabbit

• Chores
  • Improved package release reliability by using an explicit authentication token when aligning the @next distribution tag.
  • Updated release warnings to clarify when authentication credentials may be invalid or expired.

[coderabbitai]

Walkthrough

The publish workflow now uses NPM_TOKEN only for post-publish @next dist-tag alignment, while npm publish continues using OIDC. The failure warning now references revoked or expired tokens.

Changes

Publish dist-tag authentication

Layer / File(s)	Summary
Authenticate post-publish dist-tag alignment .github/workflows/publish.yml	The dist-tag command receives NPM_TOKEN, and the failure warning reflects token revocation or expiry while npm publishing remains tokenless.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• nForma-AI/nForma#354: Updates the same publish workflow’s OIDC and dist-tag authentication behavior.
• nForma-AI/nForma#366: Changes the post-publish @next dist-tag alignment behavior.
• nForma-AI/nForma#367: Modifies the same workflow area and dist-tag authentication flow.

Suggested reviewers: copilot, glittercowboy

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change, but it does not follow the required What/Why/Testing/Checklist/Breaking Changes template.	Reformat the PR description to include the required sections and add the missing Testing and Checklist items, plus a clearer What/Why summary.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main workflow change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-yml-dist-tag-npm-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 124-134: Update the dist-tag alignment step around the NPM_TOKEN
environment and npm dist-tag add command to explicitly bind the token to
registry.npmjs.org, using a temporary npm project or user configuration and
cleaning it up afterward. Preserve the existing next alias, version, success
message, and warning fallback while ensuring authentication is available before
the command runs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 19f15463-5b82-4005-9b3c-8931d954cc4b

📥 Commits

Reviewing files that changed from the base of the PR and between d295ce4 and 57a5790.

📒 Files selected for processing (1)

• .github/workflows/publish.yml