diff --git a/.github/workflows/publish-lowcoder-comps.yml b/.github/workflows/publish-lowcoder-comps.yml
index f151f878f..cc803dfc4 100644
--- a/.github/workflows/publish-lowcoder-comps.yml
+++ b/.github/workflows/publish-lowcoder-comps.yml
@@ -64,11 +64,15 @@ jobs:
       - name: Set up npm for trusted publishing
         if: steps.check.outputs.changed == 'true'
         # OIDC requires npm >=11.5.1. Pin npm 11 to avoid npm 12 install-policy changes.
-        run: npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
+        run: |
+          npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
+          npm --version
 
       - name: Publish package to npm with OIDC
         if: steps.check.outputs.changed == 'true'
-        run: npm publish --access public --registry=https://registry.npmjs.org/
+        # npm hides OIDC token-exchange failures behind ENEEDAUTH at its default
+        # log level. Show the registry's reason so publisher settings can be fixed.
+        run: npm publish --access public --registry=https://registry.npmjs.org/ --loglevel=verbose
         # lowcoder-cli writes the compiled package here; publishing the source
         # workspace would omit the generated component entry point.
         working-directory: client/packages/lowcoder-cli/.out
diff --git a/.github/workflows/publish-lowcoder-sdk.yml b/.github/workflows/publish-lowcoder-sdk.yml
index 3bbd890b6..7e796a65c 100644
--- a/.github/workflows/publish-lowcoder-sdk.yml
+++ b/.github/workflows/publish-lowcoder-sdk.yml
@@ -64,9 +64,13 @@ jobs:
       - name: Set up npm for trusted publishing
         if: steps.check.outputs.changed == 'true'
         # OIDC requires npm >=11.5.1. Pin npm 11 to avoid npm 12 install-policy changes.
-        run: npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
+        run: |
+          npm install --global npm@11.21.0 --registry=https://registry.npmjs.org/
+          npm --version
 
       - name: Publish package to npm with OIDC
         if: steps.check.outputs.changed == 'true'
-        run: npm publish --access public --registry=https://registry.npmjs.org/
+        # npm hides OIDC token-exchange failures behind ENEEDAUTH at its default
+        # log level. Show the registry's reason so publisher settings can be fixed.
+        run: npm publish --access public --registry=https://registry.npmjs.org/ --loglevel=verbose
         working-directory: client/packages/lowcoder-sdk
diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 64b825284..6259b3777 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -24,7 +24,9 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Build Java
         run: |
-          mvn clean compile -DskipTests -f ./server/api-service/pom.xml
+          # Downstream modules need the SDK's shared test-helper JAR, which is
+          # attached during package. Keep test compilation enabled for that JAR.
+          mvn --batch-mode --no-transfer-progress clean package -DskipTests -f ./server/api-service/pom.xml
       - name: SonarCloud Scan
         uses: SonarSource/sonarcloud-github-action@master
         env: