Release publish job passes a bare relative tarball path, which npm reads as a GitHub repo: 2.9.0 never reached npm #2551

Problem

The v2.9.0 release run's publish job failed, and nothing was published to npm (latest is still 2.8.0). Run 36779953369, job 110111645983.

Publishing release-tarball/modelcontextprotocol-inspector-2.9.0.tgz (2.9.0) under dist-tag 'latest'
npm error command git --no-replace-objects ls-remote ssh://git@github.com/release-tarball/modelcontextprotocol-inspector-2.9.0.tgz.git
npm error git@github.com: Permission denied (publickey).

The step resolves the downloaded artifact with set -- release-tarball/*.tgz (.github/workflows/main.yml:388) and passes the bare relative path to npm publish. npm reads an argument of the form dir/file as GitHub owner/repo shorthand, so it tried to clone github.com/release-tarball/... over SSH instead of publishing the local file.

This is the package / publish split from #2483 (PR #2506) running for the first time. It could only be exercised by a real release, which is why the v2.9.0 smoke ledger recorded #2483 on proxy evidence.

Fix

Use ./release-tarball/*.tgz. With the ./ prefix, npm treats the argument as a local path. Everything else in the step, including the publishConfig refusal, the name and version re-assertion, and the pinned registry, is unchanged.

Re-release

A release event runs the workflow from the tag's commit, so re-running the failed job would fail the same way. Once this lands on v2/main, merge v2/main into main, then delete the 2.9.0 Release and tag and recreate them at the new main commit with the same notes. npm never received 2.9.0, so the version number stays.