From ab3ade993bd640aa7191c5a7c8ac2d83889f55ea Mon Sep 17 00:00:00 2001
From: Minkyu Cho <pitzcarraldo@gmail.com>
Date: Sat, 4 Jul 2026 13:43:03 +0900
Subject: [PATCH] fix(release): restore npm publish auth checks

---
 .github/workflows/release.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index da58547..fb57450 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -201,6 +201,7 @@ jobs:
 
       - name: Publish to npm
         run: |
+          set -o pipefail
           npm publish --provenance --access public --tag ${{ steps.npm_tag.outputs.tag }} 2>&1 | tee npm-publish.log || {
             if grep -q "You cannot publish over the previously published versions" npm-publish.log; then
               echo "Version already published, skipping..."
@@ -208,6 +209,8 @@ jobs:
               exit 1
             fi
           }
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Calculate SHA256
         id: sha256
@@ -215,7 +218,7 @@ jobs:
           sleep 10
           VERSION="${{ needs.check-version.outputs.current }}"
           TARBALL_URL="https://registry.npmjs.org/@clix-so/clix-cli/-/clix-cli-${VERSION}.tgz"
-          curl -sL "$TARBALL_URL" -o package.tgz
+          curl --fail --silent --show-error --location "$TARBALL_URL" -o package.tgz
           SHA256=$(shasum -a 256 package.tgz | cut -d ' ' -f 1)
           echo "sha256=$SHA256" >> $GITHUB_OUTPUT