From c4cdb52fe6e1c7b0ddb3244fb9e3d168d67eb0f3 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Sat, 14 Feb 2026 04:31:26 -0300
Subject: [PATCH] fix(ci): reference NPM_TOKEN environment for
 environment-scoped secrets (#18)

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
---
 .github/workflows/npm-publish.yml | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 7af646a818..19a052dcb0 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -11,6 +11,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: NPM_TOKEN
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -35,18 +36,7 @@ jobs:
           npm version "$VERSION" --no-git-tag-version --allow-same-version
           echo "Publishing version: $VERSION"
 
-      - name: Configure npm auth
-        run: |
-          TOKEN="${NPM_TOKEN_SECRET:-$NPM_TOKEN_VAR}"
-          if [ -z "$TOKEN" ]; then
-            echo "❌ NPM_TOKEN not found in secrets or vars"
-            exit 1
-          fi
-          echo "//registry.npmjs.org/:_authToken=${TOKEN}" > ~/.npmrc
-          echo "✅ npm auth configured"
-        env:
-          NPM_TOKEN_SECRET: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN_VAR: ${{ vars.NPM_TOKEN }}
-
       - name: Publish to npm
         run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}