ci: Use npm registry HTTP API for dist-tag promotion (no-changelog)

[Matsuuu]

Summary

Follow-up to #28889

The release-set-stable-npm-packages-to-latest workflow was failing with 403 errors when setting latest dist-tags for scoped @n8n/* packages.

Fix: replace the npm dist-tag add CLI calls with direct fetch requests to the npm registry HTTP API (PUT /-/package/:name/dist-tags/:tag), passing NPM_TOKEN explicitly via env var. This bypasses the CLI auth resolution chain entirely and works identically for both scoped and unscoped packages.

Additional improvements:

• Network errors (thrown by fetch) are caught and reported per-package rather than crashing the whole run
• HTTP failures now log the status code and registry response body for easier debugging
• Process exits non-zero if any package fails

Related Linear tickets, Github issues, and Community forum posts

No ticket — identified from CI failure logs.

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if the PR is an urgent fix that needs to be backported)

🤖 PR Summary generated by AI

[cubic-dev-ai]

No issues found across 2 files

Architecture diagram

sequenceDiagram
    participant GHA as GitHub Actions Runner
    participant Script as Promotion Script
    participant Pnpm as Monorepo Utils
    participant Registry as npm Registry API

    Note over GHA,Registry: NEW: Direct HTTP Registry Interaction Flow

    GHA->>Script: Execute (node set-latest-for-monorepo-packages.mjs)
    Note right of GHA: Injected: NPM_TOKEN env var

    Script->>Pnpm: getMonorepoProjects()
    Pnpm-->>Script: List of package names + versions

    loop For each public package
        Script->>Script: URL-encode package name (e.g. @n8n/core -> @n8n%2fcore)
        
        Script->>Registry: CHANGED: PUT /-/package/:name/dist-tags/latest
        Note right of Script: Headers: Authorization Bearer [TOKEN]<br/>Body: "version.string"
        
        alt Success (HTTP 2xx)
            Registry-->>Script: 200 OK
            Script->>GHA: Log success
        else HTTP Error (e.g. 403, 404)
            Registry-->>Script: Error Status + Body
            Script->>GHA: NEW: Log status code and response body
            Script->>Script: Record failure
        else Network Error
            Script->>GHA: NEW: Catch fetch error and log
            Script->>Script: Record failure
        end
    end

    alt Any packages failed
        Script-->>GHA: NEW: Throw Error (Process Exit 1)
    else All packages succeeded
        Script-->>GHA: Success (Process Exit 0)
    end

Loading