Follow npm's documented OIDC publish setup - #4
Merged
Merged
Conversation
Dropping registry-url removed the placeholder token but left npm with no registry to run the OIDC exchange against, so it asked for a login instead. npm's own guidance keeps registry-url and relies on setup-node v7, which no longer writes the _authToken line when no NODE_AUTH_TOKEN exists. The cache is off because a poisoned package-manager cache can expose the OIDC token, and the bundled npm from the pinned Node already exceeds the 11.5.1 minimum. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
v1.1.4run failed withENEEDAUTH — need auth This command requires you to be logged in to https://registry.npmjs.org/. Removingregistry-urlin #3 did clear the_authTokenplaceholder that caused the earlierE404, but it also left npm without a configured registry to run the OIDC exchange against, so it fell back to asking for a login.npm's documented setup keeps
registry-urland moves setup-node to v7, whose changelog states outright that "npm Trusted Publishing (OIDC) is not affected, since it does not useNODE_AUTH_TOKEN" — v7 no longer writes the token line when no secret is present, which is what v5 got wrong.Changes:
actions/setup-node@v5→@v7registry-url: https://registry.npmjs.orgpackage-manager-cache: false, per npm's guidance that a poisoned cache can expose the OIDC tokennpm install -g npm@latest; it resolved to npm 12.0.2, and the npm bundled with the pinned Node LTS already clears the 11.5.1 minimumnode -v && npm -vstep, since neither failing run showed which npm actually ranTest path
Tag
v1.1.5on1.xafter merge. Confirm the publish job succeeds,npm view @concept7/kite versionreports1.1.5, and the release shows a provenance attestation.🤖 Generated with Claude Code