Release v1.2.5 built but failed to publish: npm 404 on PUT (auth) #154

What is broken

The repo, the git tag and CHANGELOG.md all say @neuledge/context 1.2.5 shipped, but npm still serves 1.2.4. dist-tags.latest is 1.2.4 and 1.2.5 is absent from the registry entirely.

User-visible consequence: the HTML <pre> formatting fix from #137 (preserving code formatting in bare preformatted blocks, including systemd's rendered DocBook manuals) is not in anyone's hands. Anyone installing or updating today still gets 1.2.4.

The failure

PR #152 merged as 3ff5f3b. The Release workflow run on that commit failed at the publish step:

https://github.com/neuledge/context/actions/runs/35679243166

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@neuledge%2fcontext - Not found
npm error 404  '@neuledge/context@1.2.5' is not in this registry.

The tarball built fine — 96.4 kB, 60 files, correct name and version. Only the registry PUT failed.

A 404 on PUT to a scoped package that demonstrably exists is npm's standard response to an unauthorized publish: it masks existence rather than returning 401/403.

Investigation

1. .github/workflows/release.yml auth is correct. actions/setup-node@v7 sets registry-url: 'https://registry.npmjs.org', and the changesets step passes NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}. No hand-written .npmrc, and no provenance/OIDC (id-token: write is not requested), so nothing depends on a trusted-publisher configuration.

2. release.yml has not changed since the last good publish. Its most recent commit is efa171b ("ci: build and publish on Node 22 LTS", ci: build and publish on Node 22 LTS #123) on 2026-08-25. That is before 1.2.4 published successfully on 2026-09-01 — so the exact workflow file that published 1.2.4 is the one that failed here, byte for byte.

3. packages/context/package.json has not meaningfully changed either. The only commit touching it since the 1.2.4 release commit (f79234f) is the 1.2.5 version bump itself. Diffed against f79234f: name is still @neuledge/context, publishConfig.access is still public, and the sole difference is "version": "1.2.4" → "1.2.5".

4. Last run that genuinely published: run Version Packages #67 (33466348689), 2026-09-01, "Version Packages (Version Packages #129)" → 1.2.4. Runs context add fails with 'Command failed' error on macOS #68 through Version Packages #74 all report success, but they were registry-definition merges with no changeset pending, so changesets found nothing to publish and the publish path never executed. They are not evidence that publishing works.

Verdict: not a workflow regression. Nothing in the release path changed between the last successful publish and this failure — the credential is the variable that changed. The NPM_TOKEN repo secret is expired, revoked, or no longer carries publish rights for the @neuledge scope.

Remedy (requires the repo owner)

Only the owner holds the credential, so this cannot be fixed from a PR:

1. Generate a new npm automation token with publish rights for the @neuledge scope (sole npm maintainer is moshe).
2. Update the NPM_TOKEN repository secret under Settings → Secrets and variables → Actions.
3. Re-run the failed workflow run: https://github.com/neuledge/context/actions/runs/35679243166

Re-running is safe and idempotent. 1.2.5 was never published, so there is no version collision — the publish will simply succeed this time. No revert, no version bump, and no new release PR is needed.

Worth checking the nightly registry-update workflow afterward too, since it publishes with the same secret.