From 37348f954718959bb72567e579456fca88706653 Mon Sep 17 00:00:00 2001 From: planadecu Date: Tue, 14 Jul 2026 00:16:06 +0200 Subject: [PATCH] ci: fix OIDC publish auth (drop registry-url placeholder token) The previous OIDC attempt still 404'd because actions/setup-node with registry-url writes an .npmrc with _authToken=${NODE_AUTH_TOKEN} and a placeholder token, which the publisher used instead of doing the OIDC exchange. Remove registry-url so nothing shadows OIDC, upgrade to npm >= 11.5.1 (required for trusted publishing), and publish with npm publish. --- .github/workflows/publish.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index cceda01..597b948 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -23,8 +23,11 @@ jobs: - uses: actions/setup-node@v4 with: node-version: 24 - registry-url: 'https://registry.npmjs.org' cache: 'pnpm' + # NOTE: intentionally no `registry-url`. It writes an .npmrc with + # `_authToken=${NODE_AUTH_TOKEN}` and a placeholder token, which shadows OIDC + # trusted publishing (the placeholder is used instead → E404). Leaving it out + # lets npm publish authenticate via the OIDC id-token exchange. - name: Configure Git run: | git config --global user.name 'GitHub Actions' @@ -38,8 +41,10 @@ jobs: git add package.json pnpm-lock.yaml git commit -m "Bump version [skip ci]" git push - # Publish via npm Trusted Publishing (OIDC). No token needed: pnpm exchanges the - # GitHub id-token (permissions.id-token: write above) for a short-lived publish - # credential and attaches provenance automatically. Requires a Trusted Publisher - # to be configured for this package on npmjs.com (repo + this workflow filename). - - run: pnpm publish --no-git-checks + # Publish via npm Trusted Publishing (OIDC). No token needed: npm exchanges the + # GitHub id-token (permissions.id-token: write) for a short-lived publish credential + # and attaches provenance automatically. Requires a Trusted Publisher configured for + # this package on npmjs.com (repo + this workflow filename). npm >= 11.5.1 is required + # for OIDC trusted publishing, so upgrade the bundled npm first. + - run: npm install -g npm@latest + - run: npm publish