ci(publish): fall back to NODE_AUTH_TOKEN when NPM_TOKEN secret blank

Belt and suspenders — accept either secret name, error out at config
time with a clear message if both are blank. Lets the run fail fast
in the auth step instead of opaquely in pnpm publish.

.github/workflows/publish.yml

@@ -49,15 +49,21 @@ jobs:
         # has to be on disk. setup-node@v4 sets NPM_CONFIG_USERCONFIG to
         # a temp path; we write to that exact path so pnpm picks it up.
         run: |
+          token="${NPM_TOKEN:-$NODE_AUTH_TOKEN}"
+          if [ -z "$token" ]; then
+            echo "::error::No NPM token available (NPM_TOKEN nor NODE_AUTH_TOKEN set)"
+            exit 1
+          fi
           target="${NPM_CONFIG_USERCONFIG:-$HOME/.npmrc}"
           cat > "$target" <<NPMRC
           registry=https://registry.npmjs.org/
           @luxfi:registry=https://registry.npmjs.org/
-          //registry.npmjs.org/:_authToken=${NPM_TOKEN}
+          //registry.npmjs.org/:_authToken=${token}
           always-auth=true
           NPMRC
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - run: pnpm install --frozen-lockfile || pnpm install
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "bridge",
-  "version": "1.1.6",
+  "version": "1.1.7",
   "private": true,
   "description": "Lux Bridge - Decentralized cross-chain bridge using MPC",
   "packageManager": "[email protected]",