max-voitcov
398dc2cfb4
build / build (push) Has been cancelled
The SDK job reached `npm publish` and got E401. The token Actions injects is
real and valid -- 40 characters, `GET /api/v1/user` returns 200, and it reads
the package registry as the repository owner -- but every *write* to the
registry is refused:
npm PUT (bearer, as npm) -> 401
npm PUT (basic) -> 401
Both schemes, so this is authority and not `_authToken` sending Bearer. Adding
`permissions: packages: write` to the workflow changed nothing either.
So the four publish steps now take PACKAGES_TOKEN, a repository secret holding
an access token scoped to `write:package`. goreleaser keeps the injected token:
it creates the release and uploads binaries, which is repository write, and
that half has always worked.
This is why v0.1.0's packages had to be published by hand -- the SDK job has
never once run to completion.