release: npm publish blocked — configure Trusted Publisher (or fresh NPM_TOKEN) for both packages

[johnxie]

What's broken

CI cannot publish to npm. @taskade/mcp-server@0.1.2 + @taskade/mcp-openapi-codegen@0.0.6 are versioned on main (#72) but not on npm — every Publish attempt fails E404 Not Found - PUT (npm's unauthorized-masked-as-404). Failing runs: 30353148350 (tokenless OIDC), 30353550115 (with NPM_TOKEN wired in via #73).

Root cause (verified)

1. npm OIDC trusted publishing was never configured on npmjs.com — force-release.yml has failed on every dispatch since Feb 2026 (runs 22002394603, 22002491927, 26078540906, 27230718079). The June 0.1.0/0.1.1 releases were manual token publishes from a maintainer machine, which masked this.
2. The repo secret NPM_TOKEN (updated 2026-05-19) was never referenced by any workflow until fix(ci): wire NPM_TOKEN into publish steps (OIDC trusted publishing never configured npm-side) #73 — and now that it is wired in, it still E404s, so the stored token is expired/revoked or lacks publish permission for these packages.

Fix — one of (A is better, tokenless + provenance-native):

A. Configure Trusted Publisher (npmjs.com, requires 2FA login):
For each of @taskade/mcp-server and @taskade/mcp-openapi-codegen: package page → Settings → Publishing access / Trusted publisher → GitHub Actions → org taskade, repo mcp, workflow release.yml (add force-release.yml as a second publisher if manual dispatch should also publish). Then remove the NODE_AUTH_TOKEN fallback added in #73.

B. Mint a fresh granular automation token: npmjs.com → Access Tokens → Granular, packages: both above, permission Read and write, bypass 2FA for automation → update repo secret NPM_TOKEN.

Then

Actions → Force Release → Run workflow (or re-run the failed release run). Successful publish pushes the @taskade/mcp-server@x.y.z tag, which auto-triggers publish-mcp-registry.yml so the MCP Registry updates too. Until then npm/registry stay at 0.1.1 while main is ahead.