From 085edff069cae3335acae02f1278a96a3fa9589d Mon Sep 17 00:00:00 2001 From: planadecu Date: Tue, 14 Jul 2026 00:25:49 +0200 Subject: [PATCH] ci: strip forced placeholder token so npm publish uses OIDC The setup-node .npmrc sets always-auth=true with a placeholder _authToken, which forced npm to publish with the fake token (E404) instead of doing the OIDC exchange. Overwrite that .npmrc with only the registry line so npm has no token and authenticates via OIDC trusted publishing. Also log npm --version. --- .github/workflows/publish.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index e0254fa..273eb64 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -43,10 +43,16 @@ jobs: git add package.json pnpm-lock.yaml git commit -m "Bump version [skip ci]" git push - # Publish via npm Trusted Publishing (OIDC). No token needed: npm exchanges the - # GitHub id-token (permissions.id-token: write) for a short-lived publish credential - # and attaches provenance automatically. Requires a Trusted Publisher configured for - # this package on npmjs.com (repo + this workflow filename). npm >= 11.5.1 is required - # for OIDC trusted publishing, so upgrade the bundled npm first. + # setup-node's registry-url writes an .npmrc with `always-auth=true` and a placeholder + # `_authToken`, which forces npm to send the fake token instead of doing the OIDC + # exchange (→ E404). Overwrite it with just the registry so npm has no token and must + # authenticate via OIDC trusted publishing. + - name: Clean npmrc so npm uses OIDC (not the placeholder token) + run: printf 'registry=https://registry.npmjs.org/\n' > "$NPM_CONFIG_USERCONFIG" + # Publish via npm Trusted Publishing (OIDC). npm >= 11.5.1 exchanges the GitHub + # id-token (permissions.id-token: write) for a short-lived publish credential and + # attaches provenance. Requires a Trusted Publisher configured for this package on + # npmjs.com (repo planadecu/ink-uplot + workflow file publish.yml). - run: npm install -g npm@latest + - run: npm --version - run: npm publish