From 84ab738ec717a790781058da3f9d792dd263b997 Mon Sep 17 00:00:00 2001 From: Chris Price Date: Sun, 11 Oct 2026 20:57:34 -0400 Subject: [PATCH 1/2] Drop setup-node registry-url so npm uses OIDC With registry-url set, setup-node writes an .npmrc that reads a placeholder NODE_AUTH_TOKEN, and npm publish authenticates with that placeholder instead of exchanging the GitHub OIDC token. The v2.0.0 release run failed with 404 and no provenance for that reason. --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c0b63fb..07b60a3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,10 +16,11 @@ jobs: steps: - uses: actions/checkout@v4 + # No registry-url here: with it, setup-node writes an .npmrc with a + # placeholder NODE_AUTH_TOKEN and npm uses that instead of OIDC. - uses: actions/setup-node@v4 with: node-version: 22.x - registry-url: https://registry.npmjs.org cache: npm # Trusted publishing (OIDC) needs npm 11.5.1 or newer; Node 22 ships an older npm. From 6cef8425487af8b099ab102536c5da60508bcd6c Mon Sep 17 00:00:00 2001 From: Chris Price Date: Sun, 11 Oct 2026 20:58:05 -0400 Subject: [PATCH 2/2] Log npm publish at verbose level to expose OIDC exchange errors --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 07b60a3..fc36964 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,3 +33,6 @@ jobs: - name: Publish to npm run: npm publish --access public + env: + # Surfaces the "oidc" log lines that explain a failed token exchange. + NPM_CONFIG_LOGLEVEL: verbose