From 938409076144fd8b69bb82379c803debca895fbc Mon Sep 17 00:00:00 2001 From: firejune Date: Sun, 23 Aug 2026 20:27:50 +0900 Subject: [PATCH] docs: the registry-side trusted publisher is owner work, not a given The first two automated publish runs proved the workflow side end to end (PR driven to a tested merge, tags and releases cut, OIDC id-token minted) and then failed at the registry: ENEEDAUTH, npm finding no trusted publisher to exchange its token with. Record that state honestly instead of assuming the form is filled. --- RELEASING.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/RELEASING.md b/RELEASING.md index c33980b..6599122 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -103,8 +103,10 @@ releases. ### The registry side (owner, npmjs.com) -**Configured — recorded here for when it needs to change.** The form needs -the package owner's npm account, once per package: +**Owner-side, and the one step this automation can neither do nor verify.** +The form needs the package owner's npm account, once per package — and until +it matches, every automated publish fails with `ENEEDAUTH` (npm finds no +trusted publisher willing to exchange its OIDC token): npmjs.com → *package* → **Settings** → **Trusted Publisher** → *GitHub Actions*, filled in identically for **`headerless`** and