From 8489dd95d6d48dee53ea489024dc9f9c7be916a7 Mon Sep 17 00:00:00 2001
From: ilia <idobkin@gmail.com>
Date: Wed, 15 Jul 2026 09:14:25 -0400
Subject: [PATCH] fix(release): soft-fail npm publish until package token is
 scoped

Gitea Release for v0.4.0 succeeded; npm registry returned E401 without
write:package. Keep release green and document the token follow-up.
---
 .gitea/workflows/ci.yml | 3 +++
 ROADMAP.md              | 2 +-
 docs/NPM_REGISTRY.md    | 8 ++++++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7d1df83..2ed646b 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -156,6 +156,9 @@ jobs:
             "https://git.levkin.ca/api/v1/repos/ilia/playkit/releases/${RELEASE_ID}/assets"
       - name: Publish to Gitea npm registry
         # RELEASE_TOKEN (or optional NPM_PUBLISH_TOKEN) needs write:package — docs/NPM_REGISTRY.md
+        # Soft-fail: Gitea Release + tarball already published above; package registry
+        # auth is a separate token scope and should not block the git release.
+        continue-on-error: true
         run: |
           TOKEN="${{ secrets.NPM_PUBLISH_TOKEN }}"
           if [ -z "$TOKEN" ]; then TOKEN="${{ secrets.RELEASE_TOKEN }}"; fi
diff --git a/ROADMAP.md b/ROADMAP.md
index 8574f24..4806b0d 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -14,7 +14,7 @@ Living plan for making `@levkin/playkit` more useful across Levkin repos.
 
 - [ ] End adoption pause — migrate first extra consumer (`screening` candidate)
 - [ ] Evaluate `playwright-exporter` for scheduled synthetics (may supersede bespoke cron wrappers around `playkit smoke`)
-- [ ] Optional dedicated `NPM_PUBLISH_TOKEN` (least privilege vs reuse `RELEASE_TOKEN`)
+- [ ] **Wire `NPM_PUBLISH_TOKEN` / `write:package`** — `v0.4.0` git release OK; first npm publish hit E401 (token scope). Soft-fail in CI until fixed.
 
 ## Adoption pause
 
diff --git a/docs/NPM_REGISTRY.md b/docs/NPM_REGISTRY.md
index eb3a01a..065a59e 100644
--- a/docs/NPM_REGISTRY.md
+++ b/docs/NPM_REGISTRY.md
@@ -40,3 +40,11 @@ wire it in CI (preferred if you want least privilege).
 ```bash
 npm view @levkin/playkit versions --registry https://git.levkin.ca/api/packages/ilia/npm/
 ```
+
+## Outstanding ops
+
+First `v0.4.0` Gitea Release succeeded; `npm publish` returned **E401** because `RELEASE_TOKEN` lacks `write:package`. Create/refresh a token with package write (or add `NPM_PUBLISH_TOKEN`) and either re-run the release job or publish once by hand:
+
+```bash
+npm publish --registry https://git.levkin.ca/api/packages/ilia/npm/
+```
-- 
2.49.1