Release failing since Aug 18: NPM_TOKEN rejected, nothing published since 2.15.0

The Release workflow failed on the last two pushes to main and nothing has been published since [email protected] on August 13. Failing runs are 32170126651 (Aug 18) and 32365670346 (Aug 20), both stopping at the same step:

[@semantic-release/npm] › ℹ  Verifying OIDC context for publishing from GitHub Actions
[@semantic-release/npm] › ℹ  OIDC token exchange with the npm registry failed: 404 OIDC token exchange error - package not found
[@semantic-release/npm] › ℹ  Verify authentication for registry https://registry.npmjs.org/
npm error 401 Unauthorized - GET https://registry.npmjs.org/-/whoami
[semantic-release] › ✘  EINVALIDNPMTOKEN Invalid npm token.

The registry answers 401 to whoami, so the NPM_TOKEN secret is there but no longer accepted. It worked on August 13, so it expired or was revoked in between. npm shortened the maximum lifetime of access tokens in September 2025, so classic tokens now expire on their own.

Two ways out. The quick one is rotating the secret: a granular access token with publish permission for ui-ux-pro-max-cli, saved over NPM_TOKEN, no code change. The durable one is npm trusted publishing, which @semantic-release/npm v13 already attempts first (that OIDC line above) and which release.yml already has the id-token: write permission for. The 404 means the package has no trusted publisher registered yet. Adding one on npmjs.com pointing at nextlevelbuilder/ui-ux-pro-max-skill and the release.yml workflow makes the exchange succeed, and the secret can then be deleted.

Two smaller things I ran into while reading the log.

The failure notification is broken too, which is likely why this went unnoticed. .releaserc.json sets failTitle, so @semantic-release/github tries to open an issue on failure, and that call fails with Validation Failed: {"value":"semantic-release","resource":"Label","field":"name","code":"invalid"}. The plugin labels that issue semantic-release by default and the repo has no label with that name, so no failure issue was ever created. Creating the label, or setting labels: false on the github plugin, should let it through.

And #451 does not fix this, in case it gets read as the fix. @semantic-release/npm is a direct dependency of semantic-release, so dropping the -p flag does not stop npx from installing it, and the log shows it loading from .releaserc.json, which still declares it with pkgRoot: cli. With the plugin loaded and no trusted publisher configured, lib/verify-auth.js falls through to setNpmrcAuth and throws ENONPMTOKEN instead. Same red run, different message. That PR becomes correct once the trusted publisher exists on npm.

Happy to send the workflow side of that, or the label fix, if either helps.