fix(publish): authenticate to GitHub Packages before installing (#92)

A package whose own dependencies live on GitHub Packages could not be
released. Both publish blocks ran `bun install` with no registry credentials,
so a private first-party dependency failed with 401 then 403 and the publish
step never ran. connect-basic hit this on v0.10.0: the version was bumped and
the GitHub Release created, but no artifact was ever published.

The token is now written to ~/.npmrc before install. Deliberately credentials
only — no scope mapping. The existing ordering comment explains why the
owner's scope must not be remapped this early: a package being published to
both registries for the first time would stop resolving its own npmjs.org
scope-siblings. Supplying a token for the host without touching the registry
mapping fixes the install and preserves that property, because a repository
that genuinely routes a scope to GitHub Packages already declares it in its
own .npmrc.

This is latent for any published package with a first-party dependency, not
specific to connect-basic — hono-ts uses this workflow and carries
@photon-hq/error as a devDependency.

publish-npm has the same shape and is not covered here: it only accepts an
npm-token, so giving it GitHub Packages credentials means a new input, and no
package currently publishes to npmjs.org with a private first-party dependency.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: underthestars-zhy

.github/blocks/publish-github-package/action.yaml

@@ -41,9 +41,23 @@ runs:
       with:
         bun-version: ${{ inputs.bun-version }}
 
+    # Credentials only, no scope mapping. A package whose own dependencies
+    # live on GitHub Packages needs a token to install them, but remapping the
+    # owner's scope here would break a package being published to both
+    # registries for the first time — its npmjs.org scope-siblings would stop
+    # resolving. Supplying the token without touching the registry mapping
+    # fixes the former and preserves the latter; a repository that routes a
+    # scope to GitHub Packages does so in its own .npmrc.
+    - name: Authenticate to GitHub Packages
+      shell: bash
+      env:
+        GITHUB_PACKAGES_TOKEN: ${{ inputs.github-token }}
+      run: |
+        printf '//npm.pkg.github.com/:_authToken=%s\n' \
+          "$GITHUB_PACKAGES_TOKEN" >> "$HOME/.npmrc"
+
     # Install and build before mapping the repository owner's npm scope to
-    # GitHub Packages. This keeps ordinary npmjs.org dependencies resolvable
-    # when a package is being published to both registries for the first time.
+    # GitHub Packages, for the reason above.
     - name: Install dependencies
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/blocks/publish-github-packages/action.yaml

@@ -42,6 +42,18 @@ runs:
 
     # Keep dependency installation on its existing registry configuration. The
     # GitHub Packages scope mapping is added only after dependencies are ready.
+    # Credentials only, no scope mapping — see publish-github-package for the
+    # reasoning. A package whose own dependencies live on GitHub Packages needs
+    # a token to install them; remapping the owner's scope this early would
+    # break one being published to both registries for the first time.
+    - name: Authenticate to GitHub Packages
+      shell: bash
+      env:
+        GITHUB_PACKAGES_TOKEN: ${{ inputs.github-token }}
+      run: |
+        printf '//npm.pkg.github.com/:_authToken=%s\n' \
+          "$GITHUB_PACKAGES_TOKEN" >> "$HOME/.npmrc"
+
     - name: Install dependencies
       shell: bash
       run: bun install