Fix publish workflow: yarn chokes on unset NODE_AUTH_TOKEN

[acburdine]

What broke

The v6.5.0 publish run failed at the first yarn install step:

error Error: Failed to replace env in config: ${NODE_AUTH_TOKEN}

(failed run)

Why

actions/setup-node's registry-url input always writes an .npmrc referencing ${NODE_AUTH_TOKEN} for the registry auth line, regardless of auth method. This workflow publishes via npm OIDC Trusted Publishing (permissions: id-token: write, npm 11, NPM_CONFIG_PROVENANCE: true) and never sets a NODE_AUTH_TOKEN secret — npm itself tolerates the unresolved reference fine at publish time, but yarn classic (v1), used here both to install dependencies and to run ship:ci, fails hard on any unresolved env var reference in .npmrc.

This started with the actions/setup-node v5→v7 bump (e97ba5d, 2026-07-15 23:29 UTC) — landing after v6.4.2's last successful publish (17:34 UTC same day) and before this, the first publish attempt since. v7 apparently generates the .npmrc auth line in a way the previous version didn't hit the same way.

Fix

Set NODE_AUTH_TOKEN: '' at the job level. An empty value satisfies yarn's substitution without providing (or needing) a real token, since actual publish auth goes through OIDC regardless.

Validated with actionlint (clean).

This repo will eventually move to pnpm, which doesn't have this yarn-classic quirk — this just unblocks publishing in the meantime.

Testing

Can't fully exercise the publish path without tagging a release, but the specific failing step (yarn install reading the auto-generated .npmrc) is directly addressed. Recommend a workflow_dispatch dry-run before the next real tag push to confirm.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 17 days. After that, they cost $0.25 per reviewed file.}

Or wait 24 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c0a0f1b3-5955-4ec9-bd84-ab702dc01a2c

📥 Commits

Reviewing files that changed from the base of the PR and between bd6ffb8 and 931a987.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

---

_{Comment @coderabbitai help to get the list of available commands.}