v1.6.20

fix(release): public_release job — fail-fast on missing PAT + unauth'd tag-wait

Hotfix for a confusing failure mode hit on the first v1.6.19 release.
Before PUBLIC_REPO_TOKEN was set, the public_release job's
Wait for v* tag on public repo step ran gh api --silent 2>/dev/null
against the public repo's ref endpoint. With GH_TOKEN empty (unset
secret evaluates to ""), gh CLI sends an empty bearer token and the
API returns 401 — but the --silent 2>/dev/null swallowed it and the
loop kept retrying. After 12 iterations (120s) the job errored with
"Public tag not present" even though the tag was right there on the
public repo, accessible to anonymous curl. The operator chased a
non-issue ("did release.sh public actually push the tag?") before
realizing the PAT secret was missing.

What this ship changes:

• Wait for v* tag on public repo step now uses unauthenticated
  curl against api.github.com/repos/marmutapp/superbased-observer/git/ref/tags/<tag>.
  The public repo's ref endpoint is readable anonymously, so the wait
  doesn't need a PAT. The step explicitly switches on HTTP status:
  200 → success, 404 → keep polling (expected during the wait
  window), 403 → rate-limit backoff, anything else → log + retry.
• New explicit Sanity-check PUBLIC_REPO_TOKEN is set step right
  after the wait. Fails fast with a one-line "see runbook" pointer
  if the secret isn't configured, instead of letting the downstream
  gh release create step fail with the cryptic
  gh: ... HTTP 404 (GitHub returns 404 for unauthorized cross-repo
  writes to avoid leaking repo existence — harder to debug than "PAT
  not set").

Net effect: the first-time setup failure mode now produces an
actionable error in the workflow log instead of a 2-minute
silent-401 wait. No behavior change for anyone whose PAT is already
set; the wait step's curl is functionally equivalent to the prior
gh-api call when both are reaching the public ref endpoint.

No code changes outside .github/workflows/npm-release.yml. No
schema migration. No daemon restart. Patch lands as v1.6.20 rather
than v1.6.19.1 because npm's strict SemVer 2.0.0 rejects 4-part
versions — the npm-publish step would error on a 1.6.19.1 tag.

---

Downloads

Pre-built binaries for each supported platform are attached below. Linux variants bundle antigravity-bridge.exe next to the observer binary for WSL2 users of the Antigravity adapter.

Platform	Asset
Linux x86_64	observer-v1.6.20-linux-x64.tar.gz
Linux arm64	observer-v1.6.20-linux-arm64.tar.gz
macOS x86_64 (Intel)	observer-v1.6.20-darwin-x64.tar.gz
macOS arm64 (Apple Silicon)	observer-v1.6.20-darwin-arm64.tar.gz
Windows x86_64	observer-v1.6.20-win32-x64.zip

Verify with sha256sum -c SHA256SUMS (or shasum -a 256 -c SHA256SUMS on macOS) from the directory containing the downloads.

Also available via npm: npm install -g @superbased/observer@1.6.20