auto publishing fails with NPM automation token

Describe the bug

I've setup an NPM Automation Token to allow auto to publish to npm, however, it looks like there is (still) an issue with lerna publish maybe missing --no-verify-access?

This is the workflow failing:

https://github.com/unperfekt/auto-poc/runs/4958992908?check_suite_focus=true

lerna notice cli v4.0.0
lerna info versioning independent
lerna info ci enabled
lerna WARN Unable to determine published version, assuming "@unperfekt/test-package-auto-poc-b" unpublished.
lerna WARN Unable to determine published version, assuming "@unperfekt/test-package-auto-poc-a" unpublished.
lerna info auto-confirmed 
lerna info publish Publishing packages to npm...
lerna info Verifying npm credentials
lerna http fetch GET 403 https://registry.npmjs.org/-/npm/v1/user 78ms
403 Forbidden - GET https://registry.npmjs.org/-/npm/v1/user
lerna ERR! EWHOAMI Authentication error. Use `npm whoami` to troubleshoot.

    at ChildProcess.<anonymous> (/home/runner/work/auto-poc/auto-poc/node_modules/@auto-it/core/dist/utils/exec-promise.js:58:31)
    at ChildProcess.emit (node:events:390:28)
    at Process.ChildProcess._handle.onexit (node:internal/child_process:290:12)Error
    at Object.execPromise (/home/runner/work/auto-poc/auto-poc/node_modules/@auto-it/core/dist/utils/exec-promise.js:15:22)
    at /home/runner/work/auto-poc/auto-poc/node_modules/@auto-it/npm/dist/index.js:944:30
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

Versions I'm using:

"devDependencies": {
    "auto": "^10.32.6",
    "lerna": "^4.0.0"
  },

you can also just clone the repo and take a look at it yourself: https://github.com/unperfekt/auto-poc

make sure you pass an ci automation NPM_TOKEN
make sure you edit the packge names to be able to publish

Jan 26 '22 23:01 mrtnbroder

We added a few --no-verify-access calls in https://github.com/intuit/auto/pull/2032/ , but it's possible I might have missed a spot: have you been able to use this automation token successfully elsewhere (outside of auto)?