[XELP] Move the npm release registry token to the job by ljunkie · Pull Request #4 · plexinc/brighterscript

ljunkie · 2026-08-28T02:43:51Z

The registry token was set on the two steps that obviously needed it, the published version
check and the publish itself. That is enough in this repo, which has no @plexinc
dependencies of its own, but not in the forks that do: brighterscript-formatter cannot
run npm ci without it.

Setting it once on the job removes the choice, and restores this workflow to being
identical to the copies in the other two forks.

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR centralizes npm authentication in the GitHub Actions workflow by moving NODE_AUTH_TOKEN to the job level, removing duplicated per-step configuration to make npm ci/publish harder to misconfigure.

Changes:

Add NODE_AUTH_TOKEN to the release job environment.
Remove redundant NODE_AUTH_TOKEN declarations from individual steps.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

+          # The fallback keeps this working in a fork that has no @plexinc
+          # dependencies, where the repo token is enough.
+          #
+          NODE_AUTH_TOKEN: ${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}


The token was set on the two steps that obviously needed it, the published version check and the publish. That is enough here, because this package has no @plexinc dependencies of its own, but not in the forks that do: brighterscript-formatter cannot run npm ci without it. Give it to the install step as well, and keep it off the job so it stays out of the environment of steps that never reach the network. This restores the file to being identical to the copies in the other two forks.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

+        env:
+          # Reading a dependency published from another repository requires that
+          # repository to be listed under the package's Manage Actions access.
+          # The grant is per package and is not inherited, so a newly published
+          # @plexinc package needs its consumers added before this will resolve.
+          #
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npm ci


Copilot AI lite review requested due to automatic review settings August 28, 2026 02:43

Copilot started reviewing on behalf of ljunkie August 28, 2026 02:44 View session

Copilot stopped reviewing on behalf of ljunkie due to an error August 28, 2026 02:44
An unexpected error occurred. For more details, see the detailed logs in GitHub Actions.