From 805161ce2f8135f72c3d9bb4ccbfcda42104d46e Mon Sep 17 00:00:00 2001 From: firejune Date: Sun, 23 Aug 2026 20:17:49 +0900 Subject: [PATCH] ci: drop registry-url so npm publish reaches the OIDC exchange MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup-node's registry-url writes an .npmrc with an _authToken line and exports a placeholder NODE_AUTH_TOKEN when none is provided. npm then presents that placeholder as a real token instead of attempting the trusted-publishing OIDC exchange, and the registry masks the rejection as E404 — proven live on the sibling headerless repository's first automated publish. With no auth configured at all, npm falls through to OIDC. --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7ec9709..693c06c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -146,11 +146,16 @@ jobs: - uses: actions/checkout@v4 if: ${{ steps.release.outputs.releases_created == 'true' }} + # No registry-url here, deliberately: setup-node's registry-url writes + # an .npmrc whose _authToken (a placeholder when NODE_AUTH_TOKEN is + # unset) preempts npm's OIDC exchange — the publish then presents that + # placeholder as a real token and the registry masks the rejection as + # E404. With no auth configured at all, npm falls through to trusted + # publishing. - uses: actions/setup-node@v4 if: ${{ steps.release.outputs.releases_created == 'true' }} with: node-version: 22 - registry-url: https://registry.npmjs.org # Node 22 ships npm 10; OIDC exchange landed in npm 11.5.1. - name: Use an npm that speaks OIDC