From dcdf673ec3619d13ae1ce9b41c173ad5e348d478 Mon Sep 17 00:00:00 2001 From: Mao Nakamoto Date: Sun, 16 Aug 2026 16:45:10 +0200 Subject: [PATCH] =?UTF-8?q?ci:=20OIDC=20cannot=20do=20the=20first=20publis?= =?UTF-8?q?h=20=E2=80=94=20keep=20a=20token=20for=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trusted publishing is configured per package on npmjs.com, and a package that has never been published cannot have a trusted publisher configured. The token-free workflow therefore fails on the very first release. Observed on tag v0.1.1: provenance was signed and logged to sigstore, then the PUT returned E404 'could not be found or you do not have permission' — npm answers 404 rather than 401 for an unauthenticated publish of a package that does not exist yet, which reads as a missing package rather than a missing credential. NPM_TOKEN is used only until ai-forms exists and a trusted publisher is configured; npm prefers OIDC after that. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c63e70c..34dfa77 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,7 +38,17 @@ jobs: exit 1 fi - # No token: id-token above lets the CLI exchange a short-lived OIDC - # credential with npm. Provenance is generated automatically for a public - # package from a public repo, so --provenance is not needed either. + # OIDC (id-token above) is the preferred credential: npm exchanges it for + # a short-lived one and no secret has to exist. But trusted publishing is + # configured per package on npmjs.com, and a package that has never been + # published cannot have it configured — so OIDC alone cannot do the FIRST + # publish. It fails as E404 on the PUT ("could not be found or you do not + # have permission"), which reads like a missing package rather than a + # missing credential. + # + # NPM_TOKEN covers that first publish. npm prefers OIDC when the package + # has a trusted publisher, so once this package exists and one is + # configured, this secret stops being used and can be deleted. - run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}