fix: use BUMPY_GH_TOKEN for draft release operations

.bumpy/_config.json

@@ -10,7 +10,6 @@
   // narrows down which files are considered changes
   "changedFilePatterns": ["src/**", "skills/**", "package.json", "tsconfig.json", "tsdown.config.ts"],
   "publish": {
-    "provenance": true,
-    "npmStaged": true
+    "provenance": true
   }
 }

.bumpy/fix-draft-release-token.md

@@ -0,0 +1,5 @@
+---
+'@varlock/bumpy': patch
+---
+
+Fix draft release functions (`createDraftRelease`, `updateReleaseBody`, `finalizeRelease`, `deleteRelease`) to use `BUMPY_GH_TOKEN` via `withReleaseToken` so that GitHub release events trigger downstream workflows. Also disables npm staged publishing (not yet ready) and removes the npm upgrade step from the release workflow.

.github/workflows/release.yaml

@@ -23,7 +23,6 @@ jobs:
       - uses: actions/setup-node@v6
         with:
           node-version: latest
-      - run: npm install -g npm@latest # ensure npm >= 11.15.0 for staged publishing
       - run: bun install
 
       # --- You wont need this part ---

packages/bumpy/src/core/github-release.ts

@@ -291,22 +291,22 @@ export async function createDraftRelease(
 ): Promise<void> {
   const args = ['gh', 'release', 'create', tag, '--title', title, '--notes', body, '--draft'];
   if (targetSha) args.push('--target', targetSha);
-  await runArgsAsync(args, { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(args, { cwd: rootDir }));
 }
 
 /** Update an existing GitHub release's body */
 export async function updateReleaseBody(tag: string, body: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--notes', body], { cwd: rootDir }));
 }
 
 /** Finalize a draft release (remove draft status) */
 export async function finalizeRelease(tag: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'edit', tag, '--draft=false'], { cwd: rootDir }));
 }
 
 /** Delete a GitHub release */
 export async function deleteRelease(tag: string, rootDir: string): Promise<void> {
-  await runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir });
+  await withReleaseToken(() => runArgsAsync(['gh', 'release', 'delete', tag, '--yes'], { cwd: rootDir }));
 }
 
 /** Find draft releases for a package (by name prefix) that are older than the current version */