From 41221474b0854a6028c3a2af809486d9e585c5c1 Mon Sep 17 00:00:00 2001
From: Michael Turner <mike@provable.com>
Date: Wed, 29 Jul 2026 14:42:26 -0500
Subject: [PATCH] add temporary OIDC diagnostics to the npm publish workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first OIDC publish (v0.2.2) failed with ENEEDAUTH, which npm emits
for any trusted-publishing failure without diagnostics (npm/cli#9088).
Two temporary aids to pinpoint the cause:

- A step that fails loudly if the OIDC environment is absent (the
  runner never logs the id-token permission, actions/runner#3268) and
  prints the decoded claims npm will present to the registry — never
  the token itself.
- http loglevel on the publish step to surface the token-exchange
  calls.
---
 .github/workflows/npm-publish.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index d20ea13..785319d 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -90,6 +90,26 @@ jobs:
       - name: Install pinned npm and semver CLI
         run: npm install -g npm@12.0.1 semver@7.8.5
 
+      # Temporary diagnostic while bedding in trusted publishing: npm masks
+      # OIDC failures as generic ENEEDAUTH/E404 (npm/cli#9088), so verify the
+      # job actually received an OIDC-capable environment and print the
+      # claims npm will present to the registry. Prints decoded claims only —
+      # never the token itself.
+      - name: Check OIDC environment
+        run: |
+          if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
+            echo "::error::OIDC unavailable: the id-token permission was not granted to this run."
+            exit 1
+          fi
+          echo "OIDC token request URL is present."
+          JWT="$(curl -sf -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=npm:registry.npmjs.org" | jq -r .value)"
+          node -e '
+            const c = JSON.parse(Buffer.from(process.argv[1].split(".")[1], "base64url").toString());
+            const pick = ["repository", "repository_owner", "workflow_ref", "job_workflow_ref", "ref", "environment", "event_name", "aud"];
+            console.log(JSON.stringify(Object.fromEntries(pick.map(k => [k, c[k]])), null, 2));
+          ' "$JWT"
+
       - name: Download release assets
         run: gh release download "$TAG" --pattern '*.zip' --dir artifacts
         env:
@@ -144,3 +164,7 @@ jobs:
             publish "./${pkg%/}"
           done
           publish ./dist-npm/main
+        env:
+          # Temporary while bedding in trusted publishing: surface the OIDC
+          # token-exchange HTTP calls that ENEEDAUTH otherwise hides.
+          NPM_CONFIG_LOGLEVEL: http