Why isn't NPM_AUTH_TOKEN available in push workflows, sometimes

Here’s the action history:

Here’s the workflow:

Note that it runs…:

on:
  push:
    branches:
      - main

So never on a pull_request.

What seems to happen is, if the last committer was dependabot[bot] then the secrets.NPM_AUTH_TOKEN is absent!

When the last committer is any of us on the team (we always use “Squash and merge” if that matters) then secrets.NPM_AUTH_TOKEN is working fine.