From 81331a6de30d74ca5fdbe081ab4382e552eeccb9 Mon Sep 17 00:00:00 2001 From: vigubikReply Date: Thu, 23 Jul 2026 16:39:11 -0400 Subject: [PATCH] ci: fix public publish to use OIDC trusted publishing Drop setup-node registry-url: its empty _authToken .npmrc shadowed OIDC, causing a 404 on publish. Default registry (npmjs.org) + id-token now use OIDC. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish-public.yml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish-public.yml b/.github/workflows/publish-public.yml index 1b0032a..f9d097e 100644 --- a/.github/workflows/publish-public.yml +++ b/.github/workflows/publish-public.yml @@ -29,13 +29,18 @@ jobs: with: ref: ${{ inputs.tag }} # rebuild from the exact tagged commit + # No `registry-url`: it writes an .npmrc `_authToken` line that, with no + # token set, shadows OIDC trusted publishing (npm uses the empty token and + # the registry 404s). Default registry is npmjs.org (publishConfig is + # removed below), and auth comes from OIDC. - uses: actions/setup-node@v4 with: node-version: 22 - registry-url: https://registry.npmjs.org - - name: Upgrade npm (trusted publishing needs >= 11.5.1) - run: npm install -g npm@latest + - name: Upgrade npm and show version (trusted publishing needs >= 11.5.1) + run: | + npm install -g npm@latest + npm --version - run: npm ci - run: npm run build