[FSSDK-12882] review feedback

Author: junaed-optimizely

.github/workflows/ghr_backfill.yml

@@ -30,6 +30,8 @@ jobs:
     steps:
     - name: Checkout branch
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Set up Node
       uses: actions/setup-node@v4
@@ -48,12 +50,13 @@ jobs:
       env:
         NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         DRY_RUN: ${{ github.event.inputs.dry_run }}
+        INPUT_VERSION: ${{ github.event.inputs.version }}
       run: |
         set -euo pipefail
         pkg="@optimizely/react-sdk"
 
-        if [[ -n "${{ github.event.inputs.version }}" ]]; then
-          versions="${{ github.event.inputs.version }}"
+        if [[ -n "$INPUT_VERSION" ]]; then
+          versions="$INPUT_VERSION"
         else
           versions=$(npm view "$pkg" versions --json --registry https://registry.npmjs.org | jq -r '.[]')
         fi

.github/workflows/react_release.yml

@@ -11,6 +11,8 @@ jobs:
     steps:
     - name: Checkout branch
       uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Set up Node
       uses: actions/setup-node@v4

scripts/publish.sh

@@ -12,9 +12,13 @@
 #                 of the current working directory (used by the GHR backfill).
 #
 # Env:
-#   NODE_AUTH_TOKEN  Auth token for the target registry. The caller is expected
-#                    to have configured .npmrc (e.g. via actions/setup-node) so
-#                    that @optimizely resolves to <registry-url> with this token.
+#   NODE_AUTH_TOKEN  Auth token for the target registry. The caller must have an
+#                    .npmrc entry supplying auth for <registry-url>'s host, e.g.
+#                    `//<host>/:_authToken=${NODE_AUTH_TOKEN}` (setup-node writes
+#                    this). This script passes --registry explicitly, so no
+#                    scope-to-registry routing is required (and the GHR job
+#                    intentionally does NOT route @optimizely to GHR, so that
+#                    `npm ci` still installs dependencies from npm).
 #   DRY_RUN          When "true", report what would happen (publish vs. skip)
 #                    without actually publishing.
 #