fix(ci): set registry-url so npm OIDC Trusted Publishing engages - #42
Merged
Conversation
The publish-npm.yml Set up Node step omitted registry-url, so the npm CLI never wrote the //registry.npmjs.org/ auth scaffolding it keys off to perform the OIDC token exchange. npm fell through to demanding a classic credential and both the v0.2.0 and v0.3.0 tags failed with ENEEDAUTH before publishing any package. Add registry-url: https://registry.npmjs.org to actions/setup-node, matching npm's canonical Trusted Publishing example. Under OIDC no NODE_AUTH_TOKEN is exported; the empty templated token is overridden by the OIDC exchange.
RobertoIskandarani
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
publish-npm.ymlauthenticates to npm purely via OIDC Trusted Publishing (noNPM_TOKEN). Its Set up Node step omittedregistry-url, so the npm CLI never wrote the//registry.npmjs.org/auth scaffolding it keys off to perform the OIDC token exchange. npm fell straight through to demanding a classic credential, and the publish died withENEEDAUTHbefore publishing any package.This is why the pure-OIDC path never worked: both v0.2.0 and v0.3.0 failed identically (
ENEEDAUTH, firstnpm publishstep, no OIDC attempt logged).Fix
Add
registry-url: 'https://registry.npmjs.org'toactions/setup-node, matching npm's canonical Trusted Publishing example. Under OIDC noNODE_AUTH_TOKENis exported, so the templated${NODE_AUTH_TOKEN}resolves empty; npm's OIDC exchange overrides it (this is exactly the token-less scenario npm's own example documents).The misleading comment that justified removing
registry-urlis rewritten to explain why it's required.Release note
v0.3.0 was re-tagged onto a commit carrying this same fix and is publishing from there; this PR lands the fix on
mainso the next release (0.4.0) doesn't regress.