From 1a154f396128878d7731cdf3f96cd0056ea2bfeb Mon Sep 17 00:00:00 2001
From: Vitor <vitorrggm@gmail.com>
Date: Mon, 21 Sep 2026 23:43:30 -0300
Subject: [PATCH] ci(publish): set NODE_AUTH_TOKEN for install and allow manual
 dispatch

The Publish workflow failed for every package of the 2026-09-21 release
(storefront-app 2.0.0-beta.229, storefront-template 2.0.0-beta.301,
storefront-renderer). `npm i` aborted right away with
"Failed to replace env in config: ${NODE_AUTH_TOKEN}": setup-node writes
`.npmrc` referencing that variable and, since v7 (#1300), no longer
exports a placeholder value for later steps, so npm 6 on Node 14 bails
out. With no node_modules, `npx lerna` then fell back to the runner's
global latest lerna, which crashed on Node 14.

Set NODE_AUTH_TOKEN at the job level, run the repo's lerna bin
explicitly, and add a `workflow_dispatch` input so a failed publish can
be retried for one package without re-tagging.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 7d7183f90..57de6e626 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,14 +1,24 @@
 name: Publish
 
-on: registry_package
+on:
+  registry_package:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: 'Package dir name under @ecomplus/ (e.g. storefront-app)'
+        required: true
+        type: string
 
 jobs:
   publish:
     name: Publish to npm
     runs-on: ubuntu-latest
     env:
-      PKG_OWNER: ${{ github.event.registry_package.owner.login }}
-      PKG_NAME: ${{ github.event.registry_package.name }}
+      PKG_OWNER: ${{ github.event.registry_package.owner.login || 'ecomplus' }}
+      PKG_NAME: ${{ github.event.registry_package.name || inputs.package }}
+      # setup-node writes `.npmrc` with `${NODE_AUTH_TOKEN}` and, since v7, no
+      # longer exports a placeholder: npm 6 aborts `npm i` when the var is unset
+      NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
     steps:
       - name: Checkout
@@ -24,7 +34,9 @@ jobs:
         run: npm i
 
       - name: Build package
-        run: npx lerna run --scope=@$PKG_OWNER/$PKG_NAME build
+        # explicit local bin: without node_modules `npx lerna` falls back to the
+        # runner's global (latest) lerna, which needs Node 18+ and crashes on Node 14
+        run: ./node_modules/.bin/lerna run --scope=@$PKG_OWNER/$PKG_NAME build
 
       - name: Edit package.json and publish to npm registry
         env:
@@ -37,7 +49,7 @@ jobs:
           npm publish --access public
 
       - name: Trigger Netlify deploy
-        if: github.event.registry_package.name == 'storefront-template'
+        if: env.PKG_NAME == 'storefront-template'
         env:
           NETLIFY_HOOK_ENDPOINT: ${{ secrets.NETLIFY_HOOK_ENDPOINT }}
         run: |