From 500c459461fd52ef446820dd58eef19c08ddfbe3 Mon Sep 17 00:00:00 2001 From: Mike Alhayek Date: Mon, 14 Sep 2026 16:06:20 -0700 Subject: [PATCH] Let OIDC handle npm auth instead of setup-node's placeholder token The trusted-publishing run still 404'd because setup-node's registry-url/scope inputs make it write an .npmrc with `_authToken=${NODE_AUTH_TOKEN}` and export a placeholder NODE_AUTH_TOKEN (XXXXXX-XXXXXX-...). npm treated that placeholder as credentials and published with it, never attempting OIDC -- the publish notice showed no trusted-publishing line and the PUT returned 404. Drop registry-url/scope so no auth token is configured; npm >= 11.5.1 with id-token then uses OIDC. The registry target comes from publishConfig.registry in the package's package.json. Also print node/npm versions for diagnostics. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/publish_npm.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish_npm.yml b/.github/workflows/publish_npm.yml index 2dbf205d..ec492ba8 100644 --- a/.github/workflows/publish_npm.yml +++ b/.github/workflows/publish_npm.yml @@ -115,8 +115,11 @@ jobs: if: steps.check-publish.outputs.should-publish == 'true' with: node-version: "20" - registry-url: "https://registry.npmjs.org" - scope: "@crestapps" + # Deliberately no registry-url/scope: those make setup-node write an + # .npmrc with `_authToken=${NODE_AUTH_TOKEN}` and export a placeholder + # NODE_AUTH_TOKEN. npm would then treat that placeholder as credentials + # and skip OIDC, so trusted publishing never runs. The registry comes + # from publishConfig.registry in the package's package.json instead. - name: Update npm for trusted publishing if: steps.check-publish.outputs.should-publish == 'true' @@ -135,6 +138,8 @@ jobs: working-directory: src/Resources/CrestApps.AI.Resources # No NODE_AUTH_TOKEN: authentication is handled by OIDC trusted publishing. run: | + node -v + npm -v if [ "${{ steps.check-publish.outputs.release-mode }}" = "true" ]; then VERSION="${{ steps.check-publish.outputs.release-version }}" DIST_TAG="latest"