From 67c89a853343925914b1101bbbd40965dcbae1ee Mon Sep 17 00:00:00 2001 From: Shane Waid Date: Tue, 11 Aug 2026 06:21:29 -0400 Subject: [PATCH] =?UTF-8?q?fix(ci):=20drop=20registry-url=20=E2=80=94=20se?= =?UTF-8?q?tup-node's=20placeholder=20token=20preempts=20OIDC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Proven on capitoltrace-ui's first trusted publish: registry-url makes setup-node write an .npmrc wired to a placeholder NODE_AUTH_TOKEN and npm sends that garbage token instead of performing the OIDC exchange, failing with a masked E404. Without registry-url, npm defaults to registry.npmjs.org and trusted publishing engages (ui 0.1.1 published with provenance on exactly this configuration). Co-Authored-By: Claude Fable 5 --- .github/workflows/publish.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ea0e4e8..74bed31 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -29,9 +29,12 @@ jobs: - uses: actions/setup-node@v4 with: # Trusted publishing requires Node >= 22.14. + # Deliberately NO registry-url: setting it makes setup-node write + # an .npmrc wired to a placeholder NODE_AUTH_TOKEN, and npm sends + # that garbage token instead of doing the OIDC exchange (proven on + # capitoltrace-ui's first trusted publish: masked E404). node-version: 22 cache: npm - registry-url: https://registry.npmjs.org # Trusted publishing requires npm >= 11.5.1; Node 22 bundles npm 10. - run: npm install -g npm@latest - run: npm ci