[dianaKhortiuk-frontegg]

Problem

• No release PR: none was opened after FR-25958 FR-25959 FR-25952 feat: Expo config plugin, new architecture, multi-region and getOrRefreshAccessToken #143 and FR-25950 docs: add a CHANGELOG #144 merged. The "Create Release Pull Request" job failed both times at npm whoami:

  npm error code ERR_INVALID_AUTH
  Invalid auth configuration found: `_authToken` must be renamed to `//registry.npmjs.org/:_authToken` in project config
  

• Cause: FR-25958 FR-25959 FR-25952 feat: Expo config plugin, new architecture, multi-region and getOrRefreshAccessToken #143 moved CI to Node 22 (5bcd03e), whose npm 10 rejects an unscoped _authToken line in .npmrc. Both workflows write one. On the older Node this job passed; its last success was the 13 October run.
• Publishing: onReleaseMerged.yaml writes the same line, so publishing to npm would fail too.

Change

Removes echo "_authToken=$NPM_TOKEN" >> .npmrc from onPullRequestMerged.yaml and onReleaseMerged.yaml. The next line in both files already writes the registry-scoped //registry.npmjs.org/:_authToken=$NPM_TOKEN, so npm still gets the token. Ionic Capacitor's workflows write only the scoped line.

Testing

I ran npm whoami locally on Node 22.22 / npm 10.9 with a dummy token and the same .npmrc lines as CI:

• With the unscoped line: ERR_INVALID_AUTH, the CI error.
• Without it: the config is accepted, and npm only rejects the dummy token (E401).

The real check is merging this PR: it should run "Create Release Pull Request" and open the release PR for the changes since v1.2.25.

---

Generated by Claude Code

---

Note

Low Risk
CI-only .npmrc tweak with no application or runtime behavior change; publishing still uses the same scoped registry token line.

Overview
Fixes release automation that broke after CI moved to Node 22 / npm 10: both merge workflows were writing a legacy unscoped _authToken line into .npmrc, which npm 10 rejects and caused npm whoami to fail in Create Release Pull Request and would block release publish.

This PR removes echo "_authToken=$NPM_TOKEN" >> .npmrc from onPullRequestMerged.yaml and onReleaseMerged.yaml. Auth is unchanged in practice—the workflows still set //registry.npmjs.org/:_authToken=$NPM_TOKEN, which is what npm 10 requires.

^{Reviewed by Cursor Bugbot for commit dc74f24. Bugbot is set up for automated code reviews on this repo. Configure here.}