fix(ci): configure pnpm npm registry auth before publish

pnpm 11's native publish no longer inherits auth from the NPM_TOKEN env var
the way pnpm 10's npm-CLI-shelling publish did, and pnpm 10.34.2+/11.5.3+
also stopped expanding ${VAR} placeholders from a repo's .npmrc
(GHSA-3qhv-2rgh-x77r). Explicitly run `pnpm config set` before the
changesets/action publish step, matching the pattern already used in
.github/actions/changeset-snapshot/action.yml.

Author: odinr

.github/workflows/ci.yml

@@ -50,6 +50,15 @@ jobs:
       - name: Setup node and install deps
         uses: ./.github/actions/node-setup
 
+      # pnpm 11 stopped expanding ${NPM_TOKEN}-style placeholders from a repo's
+      # .npmrc (GHSA-3qhv-2rgh-x77r), so auth has to be written via `pnpm config
+      # set` at runtime instead of relying on env-var substitution in .npmrc.
+      - name: Configure npm registry auth
+        shell: bash
+        run: pnpm config set '//registry.npmjs.org/:_authToken' "${NPM_TOKEN}"
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+
       # Process changesets: create version PR or publish packages to npm
       # This step requires write permissions to create releases and publish packages
       - name: Create Release Pull Request or Publish to npm

.github/workflows/next.yml

@@ -64,6 +64,15 @@ jobs:
       - name: Setup node and install deps
         uses: ./.github/actions/node-setup
 
+      # pnpm 11 stopped expanding ${NPM_TOKEN}-style placeholders from a repo's
+      # .npmrc (GHSA-3qhv-2rgh-x77r), so auth has to be written via `pnpm config
+      # set` at runtime instead of relying on env-var substitution in .npmrc.
+      - name: Configure npm registry auth
+        shell: bash
+        run: pnpm config set '//registry.npmjs.org/:_authToken' "${NPM_TOKEN}"
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v2