From d4f663e05b44dcf8ac3771abdcc9a703b2806521 Mon Sep 17 00:00:00 2001
From: planadecu <planadecu@gmail.com>
Date: Tue, 14 Jul 2026 00:20:01 +0200
Subject: [PATCH] ci: restore registry-url for OIDC (fixes ENEEDAUTH)

Removing registry-url left npm with no registry configured, so it couldn't
do the OIDC exchange (ENEEDAUTH). The npm docs keep registry-url: npm CLI
>= 11.5.1 detects OIDC and authenticates with it before falling back to the
setup-node placeholder token. Restore registry-url; keep npm publish.
---
 .github/workflows/publish.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 597b948..e0254fa 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,11 +23,13 @@ jobs:
       - uses: actions/setup-node@v4
         with:
           node-version: 24
+          # registry-url is required so npm knows the registry for the OIDC exchange.
+          # npm CLI (>= 11.5.1) detects the OIDC environment and authenticates with it
+          # BEFORE falling back to the setup-node placeholder token, so no NODE_AUTH_TOKEN
+          # is set on the publish step. (pnpm publish does NOT do this — it uses the
+          # placeholder and 404s — which is why we publish with npm below.)
+          registry-url: 'https://registry.npmjs.org'
           cache: 'pnpm'
-          # NOTE: intentionally no `registry-url`. It writes an .npmrc with
-          # `_authToken=${NODE_AUTH_TOKEN}` and a placeholder token, which shadows OIDC
-          # trusted publishing (the placeholder is used instead → E404). Leaving it out
-          # lets npm publish authenticate via the OIDC id-token exchange.
       - name: Configure Git
         run: |
           git config --global user.name 'GitHub Actions'