Update release.yml to remove NPM_TOKEN

[HarshTyagi8010]

Removed NPM_TOKEN from semantic-release environment.

What does this PR change?

Why?

Checklist

• Changes were made in src/ui-ux-pro-max/ (source of truth), not directly in .claude/ or .factory/
• Ran npm run sync:assets && npm run check:assets in cli/ if data/scripts/templates changed
• Added or updated tests if behavior changed (.claude/skills/*/scripts/tests/, cli/tests/e2e/)
• Commit messages follow Conventional Commits (feat:, fix:, docs:, etc.)
• This PR targets a feature branch, not pushed directly to main

[HarshTyagi8010]

Fix npm tokens

[clark-cant]

Metadata-First Review Summary

PR: #451 — Update release.yml to remove NPM_TOKEN
Author: @HarshTyagi8010
Size: +0/-2 (1 file)
mergeStateStatus: CLEAN
mergeable: MERGEABLE
reviewDecision: (none yet)

Change Analysis

This PR removes two lines from .github/workflows/release.yml:

1. NPM_TOKEN: ${{ secrets.NPM_TOKEN }} env var
2. -p @semantic-release/npm plugin

This effectively disables npm publishing from the semantic-release workflow.

Context

Related to #215 where @luantaraschi documented that uipro-cli on npm is stale (last published 2026-01-29) while development moved to ui-ux-pro-max-cli. This change may be intentional cleanup, but it's a significant CI/CD decision that needs maintainer confirmation.

Decision: Needs Maintainer Approval

• Cannot merge without explicit maintainer sign-off
• The change is valid but has downstream implications for release workflow
• @zuey or maintainers: please confirm if npm publishing should be fully removed

Posted by github-maintain cron

[clark-cant]

Request changes\n\nRemoving @semantic-release/npm disables the repository’s configured npm publish step: .releaserc.json still declares that plugin with pkgRoot: cli, and the release workflow is the place that installs/runs the semantic-release plugins. Removing NPM_TOKEN is only valid if this PR also changes the release strategy/config to intentionally stop npm publishing and documents the replacement.\n\nPlease either retain @semantic-release/npm and its required token, or include a complete, tested migration to another publishing mechanism.\n\nMandatory gates: duplicate/prior work checked (release PRs #375/#384/#393); project standards checked (CLAUDE.md); strategic necessity is not justified because the change breaks the npm release path.\n\nPosted by github-maintain cron