feat(release): pass an install token to the stage build (ENG-3550)

[Frudrax Cheng (auroursa)]

Part of ENG-3550.

Problem

package-stage installs the caller's dependencies with a token that reads GitHub Packages only. A repository whose lockfile also resolves packages from another private registry cannot be staged: the install fails, and the workflow has no way to receive a credential for that registry. The only secrets it accepts are the GitHub App pair used to notify downstream repositories.

Change

package-stage takes an optional INSTALL_TOKEN secret and sets it as $INSTALL_TOKEN for the install step. The caller uses it in its install input:

    with:
      install: pnpm install --frozen-lockfile --config.//registry.example/:_authToken="$INSTALL_TOKEN"
      pack: node scripts/pack-release.mjs
    secrets:
      INSTALL_TOKEN: ${{ secrets.REGISTRY_READ_TOKEN }}

• Only the install step sees it. verify, pack, crate packaging and the publish job do not.
• Callers that do not pass it are unaffected: the variable is empty, as an unset secret always is.
• package-promote is unchanged. It installs nothing from the caller; it publishes the stored candidates.

The build job still runs caller code with read-only permissions. The token is the caller's own secret, handed to the caller's own install script; the README asks for a read-only one.

Validation

• python3 -m unittest discover -s test: 22 tests pass locally, including a new one asserting that the secret is optional, that the install step is the only place in either workflow that references it, and that the promote workflow does not mention it.
• The release tool is untouched, so its tests are not affected.

CI on this pull request is pending.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features
  • Package staging now supports an optional read-only INSTALL_TOKEN for installing dependencies from private registries other than GitHub Packages. The token is available during installation only.
• Documentation
  • Updated the Package Stage and Promote guides with instructions for using the token.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 823e5677-80a1-4733-b16c-9ffec4c206a0

---

📥 Commits

Reviewing files that changed from the base of the PR and between 36f32d0 and 20209cd.

---

📒 Files selected for processing (3)

• .github/workflows/package-stage.yml
• README.md
• test/test_package_release_workflows.py

---

 _______________________________________________________________________________
< Fancy algorithms are slow when n is small, and n is usually small. - Rob Pike >
 -------------------------------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}