zooqueen b60ea6958c publish: read the npm token from KMS ...

KMS is where the fleet's secrets live, so the publish step reads NPM_TOKEN at
run time with the same machine identity every other workflow here uses — the
same path @hanzo/ui publishes from. Nothing new to rotate, and no npm
credential sits on the forge.

Also drops the package.json path filter. The skip step already asks the
registry whether it serves something older than this tree, which is the one
question that matters; a path gate in front of it guesses the same answer from
the shape of a diff and gets it wrong in both directions.

2026-08-13 17:07:35 -07:00

..

publish.yml

publish: read the npm token from KMS

2026-08-13 17:07:35 -07:00