From 9969e40729025d2bbc634f8be21adb5c70efc0b3 Mon Sep 17 00:00:00 2001
From: Ricardo Vega <github@noctusoft.com>
Date: Wed, 30 Sep 2026 10:21:38 -0500
Subject: [PATCH] ci: make npm trusted-publishing failures diagnosable

Log npm/node versions and publish with --loglevel verbose so the OIDC token
exchange is visible, and clear setup-node's placeholder NODE_AUTH_TOKEN so a
failed exchange is reported as an auth error rather than a misleading E404.
---
 .github/workflows/ci.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0caf2cf..910003f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -163,4 +163,9 @@ jobs:
         # match this repo. The package has no workspace: dependencies, so npm publishes pnpm's build.
         run: |
           npm install -g npm@latest
-          npm publish --access public
+          echo "node $(node --version), npm $(npm --version)"
+          npm publish --access public --loglevel verbose
+        env:
+          # setup-node injects a placeholder token; clear it so a failed OIDC exchange
+          # surfaces as an auth error instead of silently falling back to a bogus token.
+          NODE_AUTH_TOKEN: ""