[JuroUhlar]

Context

INTER-2673

Why

The release workflow publishes with npm trusted publishing, so it no longer passes an npm token it does not use.

Things to note

• release.yml already sets useTrustedPublishing: true and id-token: write. The Vue and Angular release workflows already pass only the two GitHub App keys.
• In the shared workflow (dx-team-toolkit at v1), NPM_AUTH_TOKEN is declared required: false, so omitting it is valid.

Verification

Read release-sdk-changesets.yml at v1: the only use of the secret is NPM_TOKEN: ${{ inputs.useTrustedPublishing && '' || secrets.NPM_AUTH_TOKEN }}, and with the secret not passed that value is empty. Not verified: a real release run, which only happens on merge to main.

Change outline

One secret removed from the call to the shared release workflow.

     secrets:
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
       RUNNER_APP_PRIVATE_KEY: ${{ secrets.RUNNER_APP_PRIVATE_KEY }}
-      NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}

[github-actions]

⚠️ This PR doesn't contain any changesets. If there are user-facing changes, don't forget to run:

pnpm exec changeset

to create a changeset.

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	96.79%	151/156
🟢	Branches	95.51%	85/89
🟢	Functions	97.78%	44/45
🟢	Lines	97.33%	146/150

Test suite run success

43 tests passing in 15 suites.

Report generated by 🧪jest coverage report action from cd51895

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	96.79	95.5	97.77	97.33
🟢	src	100	100	100	100
🟢	detect-env.ts	100	100	100	100
🟢	env.types.ts	100	100	100	100
🟢	...nt-context.ts	100	100	100	100
🟢	ssr.ts	100	100	100	100
🟢	...sitor-data.ts	100	100	100	100
🟢	src/components	100	100	100	100
🟢	...-provider.tsx	100	100	100	100
🟢	...vironment.tsx	100	100	100	100
🟢	src/utils	88.09	87.5	92.3	90
🟢	...is-defined.ts	100	100	100	100
🟢	...-cache-key.ts	80.76	83.33	85.71	84	5,10,43,52
🟢	to-error.ts	100	100	100	100
🟢	...mise-store.ts	100	100	100	100

[Copilot]

🟢 Approval recommended

No active review issues block the change removing the unused npm token mapping from the release workflow.

No open issues 🎉

What changed in this PR

Removes the unused npm token from the release workflow’s call to the shared workflow, which uses npm trusted publishing.

Changes:

• Stops passing NPM_AUTH_TOKEN while retaining both GitHub App private keys.

File	Description
.github/​workflows/​release.yml	Removes the unused NPM_AUTH_TOKEN secret mapping.

_{Review effort: Balanced}