From 4f44e87bf40410fa61a0db3e2591d266ef4ba47c Mon Sep 17 00:00:00 2001 From: firejune Date: Sun, 23 Aug 2026 20:28:08 +0900 Subject: [PATCH] docs: the registry-side trusted publisher is owner work, not a given MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sibling repository's first automated publish runs proved the workflow side end to end and then failed at the registry with ENEEDAUTH — npm finding no trusted publisher to exchange its OIDC token with. Record the same honest state here: the npmjs.com form is owner work the automation can neither do nor verify. --- RELEASING.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index 70865f6..9548e97 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -108,8 +108,10 @@ releases. ### The registry side (owner, npmjs.com) -**Configured — recorded here for when it needs to change.** The form needs -the package owner's npm account, once per package: +**Owner-side, and the one step this automation can neither do nor verify.** +The form needs the package owner's npm account, once per package — and until +it matches, every automated publish fails with `ENEEDAUTH` (npm finds no +trusted publisher willing to exchange its OIDC token): npmjs.com → *package* → **Settings** → **Trusted Publisher** → *GitHub Actions*, filled in identically for **`byteguard`** and