ci(release): publish with NPM_ACCESS_TOKEN

.github/workflows/release.yaml

@@ -2,12 +2,11 @@ name: Release
 
 on:
   pull_request_target:
-    types: [closed]
-    branches: [main]
+    types: [ closed ]
+    branches: [ main ]
   workflow_dispatch:
     # Manual trigger — use when a publish needs to be retried without re-merging
     # the release PR (e.g. after a partial failure where tags were already pushed).
-
 # cancel-in-progress: false ensures an in-flight publish is never interrupted.
 concurrency:
   group: release
@@ -62,12 +61,14 @@ jobs:
       - name: 🔧 Setup Node and install dependencies
         uses: ./.github/actions/node-setup-and-install
 
-      - name: 🔐 Configure npm registry for OIDC
+      - name: 🔐 Configure npm registry
         run: |
-          # Write ONLY the registry URL — no _authToken line so that npm uses
-          # the OIDC token (from id-token: write) instead of a static token.
+          # Trusted publishing (OIDC) is not configured on npmjs.com for these
+          # packages, so authenticate with NPM_ACCESS_TOKEN. id-token: write
+          # still signs the --provenance attestation.
           cat >> .npmrc << 'EOF'
           registry=https://registry.npmjs.org
+          //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
           EOF
 
       - name: 💾 Cache build outputs
@@ -82,6 +83,8 @@ jobs:
             build-${{ runner.os }}-
 
       - name: 📤 Publish to npm
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}
         run: |
           # Build packages first
           pnpm nx run-many -t build