From 11d6295735c450070ee2c777dba9a125d8875865 Mon Sep 17 00:00:00 2001
From: liutingqiu <liutingqiu@users.noreply.github.com>
Date: Fri, 23 Oct 2026 19:09:11 +0800
Subject: [PATCH] ci(release): gate npm publishing behind NPM_AUTOPUBLISH

A bad repository token made the npm job fail the whole v0.6.0 release run even
though the GitHub release and host assets were published. Automatic publishing
now requires both the NPM_AUTOPUBLISH repository variable and a valid NPM_TOKEN;
manual `npm publish` remains the default.
---
 .github/workflows/release.yml | 7 +++++--
 docs/RELEASING.md             | 6 +++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4b18d6d..05e3e94 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,6 +73,9 @@ jobs:
 
   npm:
     needs: release
+    # Automatic publishing stays off until the repository sets this variable
+    # together with a valid NPM_TOKEN. Manual `npm publish` works without it.
+    if: ${{ vars.NPM_AUTOPUBLISH == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -88,8 +91,8 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      # Set an NPM_TOKEN repository secret to publish automatically. Without
-      # it the step is skipped and the tarball remains on the GitHub release.
+      # Automatic publishing also needs NPM_AUTOPUBLISH=true and a valid
+      # NPM_TOKEN secret. Otherwise publish the release tarball manually.
       - name: publish to npm
         if: ${{ env.NODE_AUTH_TOKEN != '' }}
         run: npm publish --ignore-scripts --provenance --access public
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 91ac4ea..5f7ea0c 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -43,9 +43,9 @@ and `SHA256SUMS.txt`, packs the npm tarball, and optionally publishes to npm.
    ```
 
 5. The workflow creates the GitHub release and uploads the host archive,
-   checksums and npm tarball. To publish to npm automatically, add an
-   `NPM_TOKEN` repository secret (`npm token create`); otherwise download the
-   tarball from the release and run `npm publish`.
+   checksums and npm tarball. To publish to npm automatically, set the
+   repository variable `NPM_AUTOPUBLISH` to `true` and add a valid `NPM_TOKEN`
+   repository secret; otherwise publish manually with `npm publish`.
 
 6. Upload `assets/social-card.png` as the repository social preview in GitHub
    settings if the card changed. GitHub has no API for that image.