chore: publish offline caches with the package token

A small upload proves the token before the cache build starts.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/offline-deps.yml

@@ -19,6 +19,34 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Prove package token with a small file
+        timeout-minutes: 3
+        env:
+          TOKEN: ${{ secrets.OFFLINE_PACKAGE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "${TOKEN}" ]; then
+            echo "OFFLINE_PACKAGE_TOKEN is empty"
+            exit 1
+          fi
+          printf 'probe' > "$RUNNER_TEMP/probe.txt"
+          version="probe-${GITHUB_RUN_ID}"
+          url="${GITHUB_SERVER_URL}/api/packages/gold_land/generic/gold-land-offline-deps/${version}/probe.txt"
+          code="$(curl --silent --show-error --max-time 60 -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            --upload-file "$RUNNER_TEMP/probe.txt" \
+            "$url" || true)"
+          if [ "$code" != "201" ] && [ "$code" != "204" ]; then
+            echo "package probe upload failed with HTTP ${code}"
+            exit 1
+          fi
+          curl --fail --silent --show-error --max-time 60 \
+            -H "Authorization: token ${TOKEN}" \
+            -o "$RUNNER_TEMP/probe-down.txt" \
+            "$url"
+          cmp "$RUNNER_TEMP/probe.txt" "$RUNNER_TEMP/probe-down.txt"
+          echo "package probe ok"
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -153,7 +181,7 @@ jobs:
       - name: Upload generic package
         timeout-minutes: 10
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.OFFLINE_PACKAGE_TOKEN }}
         run: |
           set -euo pipefail
           upload() {