From e720f1ffe51889a008f8587c602a7ba47ddb1d7b Mon Sep 17 00:00:00 2001 From: drakezhang Date: Wed, 19 Aug 2026 11:20:26 +0800 Subject: [PATCH] ci(dsh-plugin): publish from the npm-publish environment The publish job named its GitHub Environment NPM_TOKEN, which is the secret name rather than a deployment target, so the repository's Deployments list showed a bogus NPM_TOKEN entry next to chrome-web-store. The environment is now npm-publish; the secret it holds keeps its name. Co-authored-by: Cursor --- .github/workflows/release-dsh-plugin.yml | 4 ++-- packages/dsh-plugin-browserskill/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-dsh-plugin.yml b/.github/workflows/release-dsh-plugin.yml index 69ae0bd..c7dacdb 100644 --- a/.github/workflows/release-dsh-plugin.yml +++ b/.github/workflows/release-dsh-plugin.yml @@ -66,8 +66,8 @@ jobs: publish: needs: [resolve, guard] runs-on: ubuntu-latest - # Secret NPM_TOKEN is stored on the GitHub Environment also named NPM_TOKEN. - environment: NPM_TOKEN + # Secret NPM_TOKEN is stored on the "npm-publish" GitHub Environment. + environment: npm-publish permissions: contents: read steps: diff --git a/packages/dsh-plugin-browserskill/README.md b/packages/dsh-plugin-browserskill/README.md index d892631..d90596c 100644 --- a/packages/dsh-plugin-browserskill/README.md +++ b/packages/dsh-plugin-browserskill/README.md @@ -187,8 +187,8 @@ git tag dsh-plugin-v0.1.0 git push origin dsh-plugin-v0.1.0 ``` -Or run the workflow from the Actions tab (`workflow_dispatch`). The job reads -`NPM_TOKEN` from the GitHub Environment of the same name. +Or run the workflow from the Actions tab (`workflow_dispatch`). The job reads the +`NPM_TOKEN` secret from the `npm-publish` GitHub Environment. ## License