ci(lotus): read the npm publish token from NPM_PUBLISH_TOKEN

Gitea reserves secret names beginning with GITEA_, so the
`GITEA_NPM_TOKEN` this workflow has referenced since the fork's first
commit could never be created — which is why CI publishing never worked
and the June release was pushed by hand. Rename to NPM_PUBLISH_TOKEN
(org secret, write:package).

Refs #22

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

.gitea/workflows/ci.yml

@@ -29,8 +29,6 @@ concurrency:
 env:
   # element-call's build:full sets 16384 already; keep parity for safety.
   NODE_OPTIONS: "--max-old-space-size=16384"
-  # Stamp the build so analytics/rageshakes aren't labelled "dev".
-  VITE_APP_VERSION: ${{ github.ref_name }}
 
 jobs:
   build:
@@ -48,8 +46,23 @@ jobs:
           registry-url: "https://code.lotusguild.org/api/packages/LotusGuild/npm/"
           scope: "@lotusguild"
 
-      - name: Enable corepack (pnpm from packageManager field)
-        run: corepack enable
+      # pnpm is installed directly (NOT via `corepack enable`): matrix-js-sdk
+      # is a git dependency that pnpm has to build from source, and its own
+      # devEngines pins a different pnpm (11.9.0). A corepack-shimmed pnpm
+      # refuses to switch versions for that nested install and the whole
+      # `pnpm install` fails (run #1854); a real pnpm binary downloads the
+      # pinned version itself. Version is read from package.json's
+      # packageManager field so it cannot drift from the lockfile.
+      - name: Install pnpm (version from packageManager field)
+        # The runner's cached Node toolchain keeps a corepack `pnpm` shim from
+        # earlier runs, and npm refuses to overwrite it (EEXIST, run #1855) —
+        # drop the shim first so the real binary lands.
+        run: |
+          B="$(dirname "$(command -v node)")"
+          corepack disable pnpm 2>/dev/null || true
+          rm -f "$B/pnpm" "$B/pnpx"
+          npm install -g "pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]")"
+          pnpm --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -71,6 +84,12 @@ jobs:
         # Stage it into embedded/web/dist — the publish template's "files" entry
         # — so the smoke-check and npm publish both see the bundle.
         # (embedded/web/dist is gitignored, hence the explicit copy.)
+        # VITE_APP_VERSION stamps the bundle so analytics/rageshakes aren't
+        # labelled "dev". Scoped to the build step only: at workflow level it
+        # also reached the unit tests, whose DeveloperSettingsTab snapshot
+        # expects the unset ("dev") value (run #1859).
+        env:
+          VITE_APP_VERSION: ${{ github.ref_name }}
         run: |
           pnpm run build:embedded
           rm -rf embedded/web/dist
@@ -110,8 +129,23 @@ jobs:
           registry-url: "https://code.lotusguild.org/api/packages/LotusGuild/npm/"
           scope: "@lotusguild"
 
-      - name: Enable corepack
-        run: corepack enable
+      # pnpm is installed directly (NOT via `corepack enable`): matrix-js-sdk
+      # is a git dependency that pnpm has to build from source, and its own
+      # devEngines pins a different pnpm (11.9.0). A corepack-shimmed pnpm
+      # refuses to switch versions for that nested install and the whole
+      # `pnpm install` fails (run #1854); a real pnpm binary downloads the
+      # pinned version itself. Version is read from package.json's
+      # packageManager field so it cannot drift from the lockfile.
+      - name: Install pnpm (version from packageManager field)
+        # The runner's cached Node toolchain keeps a corepack `pnpm` shim from
+        # earlier runs, and npm refuses to overwrite it (EEXIST, run #1855) —
+        # drop the shim first so the real binary lands.
+        run: |
+          B="$(dirname "$(command -v node)")"
+          corepack disable pnpm 2>/dev/null || true
+          rm -f "$B/pnpm" "$B/pnpx"
+          npm install -g "pnpm@$(node -p "require('./package.json').packageManager.split('@')[1].split('+')[0]")"
+          pnpm --version
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -121,6 +155,12 @@ jobs:
         # Stage it into embedded/web/dist — the publish template's "files" entry
         # — so the smoke-check and npm publish both see the bundle.
         # (embedded/web/dist is gitignored, hence the explicit copy.)
+        # VITE_APP_VERSION stamps the bundle so analytics/rageshakes aren't
+        # labelled "dev". Scoped to the build step only: at workflow level it
+        # also reached the unit tests, whose DeveloperSettingsTab snapshot
+        # expects the unset ("dev") value (run #1859).
+        env:
+          VITE_APP_VERSION: ${{ github.ref_name }}
         run: |
           pnpm run build:embedded
           rm -rf embedded/web/dist
@@ -137,8 +177,15 @@ jobs:
           TAG="${GITHUB_REF_NAME#v}"   # v0.20.1-lotus.1 -> 0.20.1-lotus.1
           npm version "$TAG" --no-git-tag-version --allow-same-version
 
+      # `--tag lotus`: npm >= 11 refuses to publish a prerelease (x.y.z-lotus.N)
+      # without an explicit dist-tag (run #1861). cinny pins exact versions, so
+      # the dist-tag is only a namespace — it keeps `latest` pointing at the
+      # last upstream-parity publish.
       - name: Publish
         working-directory: embedded/web
+        # Secret names starting with GITEA_ are reserved and can't be created, so
+        # the original `GITEA_NPM_TOKEN` never existed (every CI publish since the
+        # fork's first commit hit ENEEDAUTH). Org secret, write:package scope.
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITEA_NPM_TOKEN }}
-        run: npm publish --access public
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+        run: npm publish --access public --tag lotus

.gitignore

@@ -38,3 +38,4 @@ yarn-error.log
 
 *storybook.log
 storybook-static
+.pnpm-store/