fix: default NODE_AUTH_TOKEN to empty so install works without it

Reviewed-on: #3

.gitea/workflows/ci.yml

@@ -58,6 +58,7 @@ jobs:
         timeout-minutes: 15
         run: yarn test:e2e
         
+
   publish:
     needs: [verify, e2e]
     runs-on: ubuntu-latest
@@ -66,19 +67,33 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with: { node-version: '25' }
+      
+      - name: Check token is present
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.CAROUSEL_PACKAGE }}
+        run: |
+          if [ -z "$NODE_AUTH_TOKEN" ]; then
+            echo "NODE_AUTH_TOKEN is EMPTY — secret not injected"
+            exit 1
+          fi
+          echo "NODE_AUTH_TOKEN length: ${#NODE_AUTH_TOKEN}"
+
       - name: Enable Corepack
         run: |
           corepack enable
           corepack prepare yarn@4.11.0 --activate
       - run: yarn install --immutable
+
       - name: Assert tag matches package.json version
         run: |
           TAG="${GITHUB_REF_NAME#v}"
           PKG="$(node -p "require('./package.json').version")"
           test "$TAG" = "$PKG" || { echo "tag v$TAG != package.json $PKG"; exit 1; }
+          
       - name: Build
         run: yarn build
+        
       - name: Publish to Gitea registry
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.CI_DEPLOY_TOKEN }}
-        run: npm publish
+          NODE_AUTH_TOKEN: ${{ secrets.CAROUSEL_PACKAGE }}
+        run: yarn npm publish

.yarnrc.yml

@@ -1 +1,7 @@
 nodeLinker: node-modules
+
+npmScopes:
+  ilia:
+    npmPublishRegistry: "https://git.allmy.work/api/packages/ilia/npm/"
+    npmAlwaysAuth: true
+    npmAuthToken: "${NODE_AUTH_TOKEN:-}"