From 8207567cbab6294e3e5b489d3537f9a9dee626e7 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Fri, 24 Apr 2026 18:45:06 +0100 Subject: [PATCH] docs(release): prefer npm token workflow for dist-tags --- .agents/skills/openclaw-release-maintainer/SKILL.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.agents/skills/openclaw-release-maintainer/SKILL.md b/.agents/skills/openclaw-release-maintainer/SKILL.md index 6fe6eba5078..1c11e0b10b6 100644 --- a/.agents/skills/openclaw-release-maintainer/SKILL.md +++ b/.agents/skills/openclaw-release-maintainer/SKILL.md @@ -341,6 +341,10 @@ node --import tsx scripts/openclaw-npm-postpublish-verify.ts `openclaw/releases-private/.github/workflows/openclaw-npm-dist-tags.yml` workflow because `npm dist-tag` management needs `NPM_TOKEN`, while the public npm release workflow stays OIDC-only. +- Prefer fixing the private workflow token path over any local 1Password + fallback. The desired setup is a granular npm token stored as the private + repo's `NPM_TOKEN` secret, scoped to the `openclaw` package with read/write + and 2FA bypass for automation. - If the private dist-tag workflow cannot promote because `NPM_TOKEN` is absent or stale, use the local tmux + 1Password fallback: - Start or reuse a tmux session so interactive `npm login` and OTP prompts