@smoothbricks/cli 0.11.15 → 0.11.17

package/src/monorepo/managed-files.ts

@@ -170,6 +170,8 @@ export interface ManagedFileContext {
   nodeModulesCacheKey: string;
   repoName: string;
   platformTargetGlobs: string[];
+  /** Platform families the release workflow produces; excluded families are absent. */
+  releasePlatformTargetGlobs: string[];
   macosPlatformArchitectures: string[];
   /** Declared private-npm opt-in from the root smoo config; absent means fully public. */
   privateNpm?: PackagePrivateNpmConfig;
@@ -221,6 +223,12 @@ const managedFiles: ManagedFile[] = [
     source: 'tooling/direnv/secret-references.ts',
     target: 'tooling/direnv/secret-references.ts',
   },
+  {
+    kind: 'raw',
+    source: 'tooling/direnv/toolchain-stamp.ts',
+    target: 'tooling/direnv/toolchain-stamp.ts',
+    executable: true,
+  },
   {
     kind: 'raw',
     source: 'tooling/direnv/devenv.smoo.nix',
@@ -409,7 +417,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         release: context.hasReleasePackages,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
-        platformTargetGlobs: context.platformTargetGlobs,
+        platformTargetGlobs: context.releasePlatformTargetGlobs,
         macosPlatformArchitectures: context.macosPlatformArchitectures,
         runsOn: context.ciRunsOn,
         macosRunsOn: context.macosRunsOn,
@@ -451,6 +459,14 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
   const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
   const targetNames = targetNamesFromProjects(nxProjects);
   const platformTargetGlobs = platformTargetGlobsForTest(targetNames);
+  // The release workflow produces every platform family the graph carries
+  // EXCEPT the ones the repository excludes. An excluded family renders no job
+  // at all rather than a job whose failure blocks every release; the workflow
+  // that does own it says so itself.
+  const releasePlatformTargetGlobs = releasePlatformTargetGlobsFor(
+    platformTargetGlobs,
+    github?.releasePlatformFamiliesExcluded,
+  );
   const privateNpm = resolvePrivateNpmWorkflowConfig(root);
   // Cache registry identity plus the lockfile, never token values: a scope
   // URL change in the committed .npmrc must invalidate the dependency cache,
@@ -479,10 +495,13 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
     nodeModulesCacheKey,
     repoName,
     platformTargetGlobs,
+    releasePlatformTargetGlobs,
     sourceCheckouts,
     cargoCredentials,
     remoteCache: manifest?.smoo?.remoteCache,
-    macosPlatformArchitectures: macosPlatformArchitecturesForTest(targetNames),
+    macosPlatformArchitectures: MACOS_PLATFORM_TARGET_GLOBS.some((glob) => releasePlatformTargetGlobs.includes(glob))
+      ? macosPlatformArchitecturesForTest(targetNames)
+      : [],
     privateNpm,
   };
 }
@@ -491,6 +510,21 @@ export function hasExactTargetForTest(targetNames: Iterable<string>, target: str
   return [...targetNames].includes(target);
 }
 
+/**
+ * The platform families the release workflow produces: the graph's families
+ * minus the ones the repository excludes. Excluding a family the graph does not
+ * have is not an error — a repository states what it does not release, and the
+ * statement stays true when the target is added later.
+ */
+export function releasePlatformTargetGlobsFor(
+  platformTargetGlobs: readonly string[],
+  excluded: readonly string[] | undefined,
+): string[] {
+  if (!excluded || excluded.length === 0) return [...platformTargetGlobs];
+  const drop = new Set(excluded);
+  return platformTargetGlobs.filter((glob) => !drop.has(glob));
+}
+
 export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
   const names = [...targetNames];
   return PLATFORM_TARGET_GLOBS.filter((glob) => {

package/src/monorepo/publish-workflow.ts

@@ -49,6 +49,7 @@ const synchronizedPrettier = makeModuleSynchronized<typeof PrettierModule>(impor
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
 export type PublishWorkflowCondition =
+  | 'plan-mode-not-none'
   | 'version-mode-not-none'
   | 'deploy-production'
   | 'deploy-production-standalone'
@@ -65,6 +66,7 @@ export enum PublishWorkflowStepKind {
   ConfigureReleaseAuthor = 'configure-release-author',
   BuildNxVersionActions = 'build-nx-version-actions',
   RepairPendingReleases = 'repair-pending-releases',
+  PlanRelease = 'plan-release',
   VersionRelease = 'version-release',
   CheckManagedMonorepoFiles = 'check-managed-monorepo-files',
   Build = 'build',
@@ -159,6 +161,12 @@ export interface PublishWorkflowCallbacks {
   buildNxVersionActions(): Promise<void>;
   repairPendingReleases(input: { dryRun: boolean }): Promise<void>;
   versionRelease(input: { bump: PublishWorkflowBump; dryRun: boolean }): Promise<PublishWorkflowVersionOutputs>;
+  /**
+   * The selection the bump WILL make, computed without writing anything, so the
+   * gates that run before the version commit know what to run over. Defaults to
+   * a dry-run `versionRelease` when a caller supplies none.
+   */
+  planRelease?(input: { bump: PublishWorkflowBump }): Promise<PublishWorkflowVersionOutputs>;
   checkManagedMonorepoFiles(): Promise<void>;
   nxRunMany(input: { target: PublishWorkflowNxTarget; projects: string[] }): Promise<void>;
   uploadTraceDbs(): Promise<void>;
@@ -183,6 +191,9 @@ type PublishWorkflowStepInput = Omit<PublishWorkflowStep, 'number'>;
 
 export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions = {}): PublishWorkflowDefinition {
   const versionMode = githubExpression('steps.version.outputs.mode');
+  // Steps that run before the bump must label themselves from the plan: the
+  // version step's outputs do not exist yet, so the interpolation renders empty.
+  const planMode = githubExpression('steps.plan.outputs.mode');
   if (options.release === false) {
     return { steps: defineDeployOnlyWorkflowSteps(options) };
   }
@@ -224,30 +235,37 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
         kind: PublishWorkflowStepKind.RepairPendingReleases,
         name: '🧯 Repair pending releases',
       },
-      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      // Plan first, gate second, bump third. Lint and test hash the source, so
+      // running them BEFORE the version commit means their task hashes match
+      // the ones ci already computed for the same source — the publish reuses
+      // that cache instead of re-running 189 tasks. Build stays after the bump
+      // on purpose: an artifact built from pre-bump sources would ship the
+      // previous version string.
+      { kind: PublishWorkflowStepKind.PlanRelease, name: '🧭 Plan release', id: 'plan' },
       {
         kind: PublishWorkflowStepKind.CheckManagedMonorepoFiles,
-        name: `✅ Check managed monorepo files (${versionMode})`,
-        condition: 'version-mode-not-none',
-      },
-      {
-        kind: PublishWorkflowStepKind.Build,
-        name: `🔨 Build (${versionMode})`,
-        condition: 'version-mode-not-none',
-        nxTarget: 'build',
+        name: `✅ Check managed monorepo files (${planMode})`,
+        condition: 'plan-mode-not-none',
       },
       {
         kind: PublishWorkflowStepKind.Lint,
-        name: `🔍 Lint (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🔍 Lint (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'lint',
       },
       {
         kind: PublishWorkflowStepKind.UnitTests,
-        name: `🧪 Unit Tests (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🧪 Unit Tests (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'test',
       },
+      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      {
+        kind: PublishWorkflowStepKind.Build,
+        name: `🔨 Build (${versionMode})`,
+        condition: 'version-mode-not-none',
+        nxTarget: 'build',
+      },
       { kind: PublishWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs', condition: 'failure' },
       {
         kind: PublishWorkflowStepKind.ValidateMonorepoConfig,
@@ -302,10 +320,11 @@ export async function runPublishWorkflow(
 ): Promise<PublishWorkflowRunResult> {
   let setupOutputs: PublishWorkflowSetupOutputs = { nixCacheHit: '', devenvCacheHit: '' };
   let version: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
+  let plan: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
   let failed = false;
   let failure: unknown;
   for (const step of workflow.steps) {
-    if (!shouldRunStep(step, version, failed, context.inputs)) {
+    if (!shouldRunStep(step, version, failed, context.inputs, plan)) {
       continue;
     }
     try {
@@ -331,6 +350,11 @@ export async function runPublishWorkflow(
             dryRun: context.inputs.dryRun,
           });
           break;
+        case PublishWorkflowStepKind.PlanRelease:
+          plan = context.callbacks.planRelease
+            ? await context.callbacks.planRelease({ bump: context.inputs.bump })
+            : await context.callbacks.versionRelease({ bump: context.inputs.bump, dryRun: true });
+          break;
         case PublishWorkflowStepKind.VersionRelease:
           version = await context.callbacks.versionRelease(context.inputs);
           break;
@@ -343,7 +367,12 @@ export async function runPublishWorkflow(
           if (!step.nxTarget) {
             throw new Error(`Workflow step ${step.kind} is missing an Nx target.`);
           }
-          await context.callbacks.nxRunMany({ target: step.nxTarget, projects: version.projects });
+          // Lint and test run before the bump exists, so they select from the
+          // plan; build runs after it and selects from the written version.
+          await context.callbacks.nxRunMany({
+            target: step.nxTarget,
+            projects: step.kind === PublishWorkflowStepKind.Build ? version.projects : plan.projects,
+          });
           break;
         case PublishWorkflowStepKind.UploadTraceDbs:
           await context.callbacks.uploadTraceDbs();
@@ -383,7 +412,11 @@ function shouldRunStep(
   version: PublishWorkflowVersionOutputs,
   failed: boolean,
   inputs: PublishWorkflowInputs,
+  plan: PublishWorkflowVersionOutputs = version,
 ): boolean {
+  if (step.condition === 'plan-mode-not-none') {
+    return plan.mode !== 'none';
+  }
   if (step.condition === 'version-mode-not-none') {
     return version.mode !== 'none';
   }
@@ -404,8 +437,17 @@ export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOpti
   if (options.release === false) {
     const steps = definePublishWorkflow(options).steps;
     workflow = `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
-  } else if (hasMacosPlatformTargets(options)) {
+  } else if (hasMacosPlatformTargets(options) && !skipsPublishHandoff(options)) {
     workflow = renderPlatformPublishWorkflowYaml(options);
+  } else if (hasMacosPlatformTargets(options)) {
+    // A linux-cross producer runs the Apple targets on the publisher's own
+    // runner. Splitting jobs then buys nothing and costs a real transfer: the
+    // outputs get tarred, uploaded, downloaded into a second checkout, and two
+    // more devenv setups pay for themselves twice. One job, no artifacts.
+    workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
+      definePublishWorkflow(options).steps,
+      options,
+    )}`;
   } else if (hasLinuxPlatformTargets(options)) {
     workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
       definePublishWorkflow(options).steps,
@@ -475,7 +517,7 @@ jobs:
   publish:
 ${options.release === false ? renderRunsOnLine(options.runsOn) : publishJobRunsOnLine(options)}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}${platformProducerJobEnv(options)}
     steps:
 `;
 }
@@ -572,6 +614,16 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         ...privateNpmPublisherStepEnv(options),
         `        run: smoo release repair-pending --dry-run "${githubExpression('inputs.dry_run')}"`,
       ];
+    case PublishWorkflowStepKind.PlanRelease:
+      // The same selection the bump will make, computed without writing: the
+      // gates need `mode` and `projects` before any version commit exists.
+      return [
+        `      - name: ${step.name}`,
+        '        id: plan',
+        '        run:',
+        `          smoo release version --bump "${githubExpression('inputs.bump')}" --projects "${githubExpression('inputs.projects')}" --dry-run "true" --github-output`,
+        '          "$GITHUB_OUTPUT"',
+      ];
     case PublishWorkflowStepKind.VersionRelease:
       return [
         `      - name: ${step.name}`,
@@ -592,12 +644,12 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
     case PublishWorkflowStepKind.Lint:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UnitTests:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UploadTraceDbs:
       return artifactStepLines(
@@ -686,8 +738,11 @@ function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflo
 }
 
 function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
-  const condition = "steps.version.outputs.mode != 'none'";
-  return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
+  // A step gated on the plan must read the PLAN's mode: it runs before the
+  // version step exists, and `steps.version.outputs.mode` is empty there, which
+  // silently skips the gate rather than running it.
+  const source = step.condition === 'plan-mode-not-none' ? 'plan' : 'version';
+  return [`      - name: ${step.name}`, `        if: steps.${source}.outputs.mode != 'none'`, `        run: ${run}`];
 }
 
 function siblingSourceCheckoutStepLines(options: PublishWorkflowDefinitionOptions): string[] {
@@ -749,11 +804,25 @@ function renderSingleJobPublishWorkflowSteps(
   options: PublishWorkflowDefinitionOptions,
 ): string {
   const lines: string[] = [];
+  const producer = options.platformProducer;
+  const crossOnThisRunner = skipsPublishHandoff(options) && hasMacosPlatformTargets(options);
   for (const step of steps) {
     lines.push(...sectionLinesBefore(step));
     lines.push(...commentLinesForStep(step));
     lines.push(...yamlLinesForStep(step, options));
     lines.push('');
+    if (crossOnThisRunner && producer && step.kind === PublishWorkflowStepKind.Checkout) {
+      // Before any toolchain setup or build, exactly as the dedicated producer
+      // job ordered it: the SDK has to be on disk before devenv resolves it.
+      lines.push(
+        '      - name: Check cross-platform toolchain prerequisites',
+        '        working-directory: .',
+        '        run: |',
+        '          set -euo pipefail',
+        ...producer.preflight.split('\n').map((line) => `          ${line}`),
+        '',
+      );
+    }
     if (step.kind === PublishWorkflowStepKind.Build) {
       lines.push(
         '      - name: 🐧 Build supplemental Linux targets',
@@ -763,6 +832,16 @@ function renderSingleJobPublishWorkflowSteps(
         )}"`,
         '',
       );
+      if (crossOnThisRunner) {
+        lines.push(
+          '      - name: 🍎 Build selected macOS and iOS release outputs',
+          "        if: steps.version.outputs.mode != 'none'",
+          `        run: smoo github-ci nx-run-many --targets "${macosPlatformFamilies(options).join(',')}" --projects "${githubExpression(
+            'steps.version.outputs.projects',
+          )}"`,
+          '',
+        );
+      }
     }
   }
   return `${lines.join('\n').trimEnd()}\n`;
@@ -1423,6 +1502,41 @@ function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }
 
+/**
+ * Whether the separate publishing job can be dropped, so the release runs as
+ * one job that builds every artifact and publishes them.
+ *
+ * The hand-off exists for ONE reason: npmjs mints provenance from the
+ * publishing job's OIDC token and refuses a self-hosted runner for it, so a
+ * release with public packages must publish from the GitHub-hosted runner and
+ * therefore has to receive its self-hosted artifacts through an artifact.
+ * A release that publishes only to the declared private registry has no such
+ * constraint; when its Apple targets are cross-built on the same runner (or it
+ * has none), one job holds everything.
+ */
+function skipsPublishHandoff(options: PublishWorkflowDefinitionOptions): boolean {
+  if (options.actionsProvider !== 'forgejo' || options.privateNpm === undefined) {
+    return false;
+  }
+  return !hasMacosPlatformTargets(options) || options.platformProducer?.kind === 'linux-cross';
+}
+
+/**
+ * Toolchain environment for a foreign-platform producer, rendered onto whichever
+ * job runs its builds. In the flattened single-job shape that is the publish job
+ * itself, so the SDK path and cross flags have to reach it the same way the
+ * dedicated producer job received them.
+ */
+function platformProducerJobEnv(options: PublishWorkflowDefinitionOptions): string {
+  const producer = options.platformProducer;
+  if (!producer || !skipsPublishHandoff(options)) {
+    return '';
+  }
+  return Object.entries(producer.env ?? {})
+    .map(([name, value]) => `\n      ${name}: ${JSON.stringify(value)}`)
+    .join('');
+}
+
 function privateNpmInstallJobEnv(options: PublishWorkflowDefinitionOptions): string {
   const tokenEnv = options.privateNpm?.readTokenEnv;
   if (!tokenEnv) {

package/src/monorepo/secret-references.test.ts

@@ -206,7 +206,7 @@ describe('registryAuthEnvNames', () => {
 
   it('collects ${VAR} references from .npmrc text', async () => {
     expect(
-      await names('@axe.sc:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
+      await names('@acme:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
     ).toEqual(['SMOO_READ_TOKEN']);
   });
 

package/src/release/__tests__/private-npm-status.test.ts

@@ -433,6 +433,43 @@ describe('private npm published-version status', () => {
     });
   });
 
+  it('reads through a repository .npmrc whose own auth line names an unset env', async () => {
+    // The shape that cost a day: a repository commits
+    // `//host/path:_authToken=${NPM_PUBLISH_TOKEN}` at the workspace root.
+    // npm ranks that project file ABOVE the userconfig this CLI writes, so with
+    // the publish env unset it sent the unexpanded value and the registry
+    // answered 401 — with a perfectly good read credential in hand.
+    await withStatusFixture(async ({ fixture, root, userconfig }) => {
+      await fixture.privateRegistry.publishPackage({ name: PRIVATE_PACKAGE, version: PRIVATE_VERSION });
+      const resolved = loopbackRegistry(fixture.privateRegistry);
+      await writeFile(
+        join(root, '.npmrc'),
+        `${resolved.scope}:registry=${resolved.registry}\n${resolved.authKey}=\${NOT_SET_ANYWHERE}\n`,
+      );
+
+      // Control: with the userconfig alone the project file wins, so the token
+      // npm sends is the unexpanded reference — the registry sees no usable
+      // credential. Asserted on the wire, because a fixture that answers
+      // anonymous reads would let the server's verdict hide it.
+      await npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+        registry: fixture.privateRegistry.registry,
+        userconfig,
+      });
+      const overridden = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(overridden?.authorization ?? '').not.toContain(FIXTURE_READ_TOKEN);
+
+      await expect(
+        npmPublishedVersionExists(root, PRIVATE_PACKAGE, PRIVATE_VERSION, {
+          registry: fixture.privateRegistry.registry,
+          userconfig,
+          credential: { authKey: resolved.authKey, tokenEnv: FIXTURE_READ_TOKEN_ENV },
+        }),
+      ).resolves.toBe(true);
+      const authenticated = fixture.privateRegistry.requestsFor('probe').at(-1);
+      expect(authenticated?.authorization ?? '').toContain(FIXTURE_READ_TOKEN);
+    });
+  });
+
   it('reports a genuine not-found as absent', async () => {
     await withStatusFixture(async ({ fixture, root, userconfig }) => {
       fixture.privateRegistry.failWith(404);

package/src/release/__tests__/private-npm-workflow.test.ts

@@ -86,17 +86,37 @@ describe('private npm workflow token selection', () => {
   });
 
   it('ignores workspace and link specs so a producer install does not look like a registry consume', async () => {
+    // Without a declared read token, the .npmrc credential is a publish
+    // credential and must never be promoted into the read role by inference.
     await withRepo(
       {
         privatePackage: `${SCOPE}/sdk`,
         rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
         extraDeps: { [`${SCOPE}/other`]: 'link:@priv.test/other' },
         npmrcAuthEnv: PUBLISH_ENV,
+        declared: { scope: SCOPE, publishTokenEnv: PUBLISH_ENV },
+      },
+      (root) => {
+        expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
+          scope: SCOPE,
+          publishTokenEnv: PUBLISH_ENV,
+        });
+      },
+    );
+  });
+
+  it('renders a declared read token for a producer, whose later releases read the previous tag state', async () => {
+    await withRepo(
+      {
+        privatePackage: `${SCOPE}/sdk`,
+        rootDeps: { [`${SCOPE}/sdk`]: 'workspace:*' },
+        npmrcAuthEnv: PUBLISH_ENV,
         declared: { scope: SCOPE, readTokenEnv: READ_ENV, publishTokenEnv: PUBLISH_ENV },
       },
       (root) => {
         expect(resolvePrivateNpmWorkflowConfig(root)).toEqual({
           scope: SCOPE,
+          readTokenEnv: READ_ENV,
           publishTokenEnv: PUBLISH_ENV,
         });
       },

package/src/release/index.ts

@@ -48,6 +48,7 @@ export {
   type PrivateNpmRegistryConfigErrorKind,
   type PublishDestination,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   privateNpmUserconfigContent,
   publishPrivateWithDiagnostics,
   type Result as PrivateNpmResult,
@@ -58,6 +59,7 @@ export {
   withPrivateNpmUserconfig,
 } from './private-npm.js';
 
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import {
@@ -114,6 +116,7 @@ import {
   npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry,
   type PrivateNpmRegistry,
   privateNpmPublishArgs,
+  privateNpmTokenEnvForMode,
   publishPrivateWithDiagnostics,
   selectPublishDestination,
   selectRegistryForPackage,
@@ -754,7 +757,13 @@ async function publishPrivatePackedPackage(
       await publishPrivateWithDiagnostics(
         pkg,
         {
-          publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+          publish: () =>
+            runNpm(root, args, {
+              NPM_CONFIG_USERCONFIG: userconfig,
+              // Env config outranks a committed project `.npmrc` auth line; see
+              // npmStatusEnv in private-npm.ts for why that matters here.
+              [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+            }),
           // The open publish userconfig already authenticates this registry,
           // so the failure probe reuses it. Opening a second read-mode
           // userconfig here demanded a read credential the publishing job need
@@ -764,6 +773,7 @@ async function publishPrivatePackedPackage(
             npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
               registry: registry.registry,
               userconfig,
+              credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
             }),
           log: (message) => console.log(message),
           error: (message) => console.error(message),
@@ -1197,6 +1207,17 @@ function releaseRepairShell(root: string, platformOutputs: readonly string[]): R
       const sourceSha = await gitHead(root);
       const outputs = platformOutputs.map((base) => join(base, sourceSha));
       if (outputs.length === 0) {
+        // No producer job handed outputs over, so this runner is the producer:
+        // build the platform legs at the checked-out ref. `build` alone gives a
+        // package only the legs its own graph depends on — the host one and
+        // whatever it declares — and the release gate demands the whole declared
+        // native closure, so a foreign leg it never asked for was simply absent.
+        console.log('Repair pending releases: building cross-platform outputs on this runner.');
+        await githubCiNxRunMany(root, {
+          targets: PLATFORM_TARGET_GLOBS.join(','),
+          projects: releasePackageProjects(packages),
+          allowEmptyProjects: true,
+        });
         return;
       }
       console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1865,7 +1886,11 @@ async function npmVersionExists(root: string, name: string, version: string): Pr
     return npmPublishedVersionExistsOnRegistry(root, name, version);
   }
   return withPrivateNpmUserconfig(registry, 'read', (userconfig) =>
-    npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }),
+    npmPublishedVersionExistsOnRegistry(root, name, version, {
+      registry: registry.registry,
+      userconfig,
+      credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }),
   );
 }
 

package/src/release/private-npm.ts

@@ -247,7 +247,12 @@ export function resolvePrivateNpmWorkflowConfig(root: string): PackagePrivateNpm
     return undefined;
   }
   const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-  const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+  // A publishing workspace reads the registry too: every release after the
+  // first checks the previous tag's durable state, and that check runs in the
+  // producer jobs that never see the publish credential. A declared read token
+  // therefore always renders; only the .npmrc fallback stays consumer-only, so
+  // a publish token is never promoted into a read role by inference.
+  const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
   const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
   if (!readTokenEnv && !publishTokenEnv) {
     return undefined;
@@ -412,10 +417,30 @@ export async function withPrivateNpmUserconfig<T>(
 export interface NpmStatusOptions {
   registry?: string;
   userconfig?: string;
+  /** Path-scoped auth key and token env, so the credential can ride env config. */
+  credential?: { authKey: string; tokenEnv: string };
 }
 
-function npmStatusEnv(userconfig: string | undefined): Record<string, string> | undefined {
-  return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(
+  userconfig: string | undefined,
+  credential?: { authKey: string; tokenEnv: string },
+): Record<string, string> | undefined {
+  if (!userconfig) return undefined;
+  const env: Record<string, string> = { NPM_CONFIG_USERCONFIG: userconfig };
+  const token = credential ? process.env[credential.tokenEnv] : undefined;
+  if (credential && token) {
+    env[`npm_config_${credential.authKey}`] = token;
+  }
+  return env;
 }
 
 function npmCommandFailedMessage(npmArgs: string[], exitCode: number, stdout = '', stderr = ''): string {
@@ -439,7 +464,7 @@ export async function npmPublishedVersionExists(
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }
@@ -455,7 +480,7 @@ export async function npmPackageExists(root: string, name: string, options: NpmS
   if (options.registry) {
     args.push('--registry', options.registry);
   }
-  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+  const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
   if (result.exitCode === 0) {
     return true;
   }