ci: switch npm publish to classic NPM_TOKEN auth #2

	name: Publish to npm

	# Tag v* ⇒ npm publish.
	#
	# Auth: classic NPM_TOKEN (granular access token with publish rights on
	# call2me-sdk). Stored as a repo secret named NPM_TOKEN — see
	# https://github.com/call2me-app/node-sdk/settings/secrets/actions
	#
	# We left provenance OFF on purpose: it requires npm Trusted Publishing,
	# which we couldn't configure for this package. If you set it up later,
	# add `--provenance` and `id-token: write` to the permissions block.

	on:
	push:
	tags: ["v*"]
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	publish:
	runs-on: ubuntu-latest
	environment:
	name: npm
	url: https://www.npmjs.com/package/call2me-sdk
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: "20"
	registry-url: "https://registry.npmjs.org"
	- name: Verify tag matches package.json
	run: \|
	PV=$(node -p "require('./package.json').version")
	TV="${GITHUB_REF_NAME#v}"
	[ "$PV" = "$TV" ] \|\| { echo "package.json $PV != tag $TV"; exit 1; }
	- name: Publish
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	run: npm publish --access public

Provide feedback