From 89145294be76d51ab47ab973ae731c74711cd885 Mon Sep 17 00:00:00 2001
From: Automaker <automaker@localhost>
Date: Sun, 24 May 2026 23:11:32 -0700
Subject: [PATCH 1/3] ci(release): drop setup-node registry-url so OIDC isn't
 shadowed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first OIDC attempt still failed: setup-node's `registry-url` writes
a temp .npmrc (`_authToken=${NODE_AUTH_TOKEN}`, always-auth=true) and
injects a placeholder NODE_AUTH_TOKEN=XXXXX-XXXXX-…, which npm treats as
real auth and skips the OIDC exchange. Removing registry-url stops the
placeholder; the committed root .npmrc still sets the registry, so
npm@latest does the OIDC trusted-publish exchange. (#245/#247 root cause.)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index be66abd24..f8326b95d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,7 +53,13 @@ jobs:
         with:
           node-version-file: '.nvmrc'
           cache: npm
-          registry-url: https://registry.npmjs.org
+          # NOTE: deliberately no `registry-url`. setup-node's registry-url
+          # writes a temp .npmrc with `_authToken=${NODE_AUTH_TOKEN}` +
+          # always-auth=true and injects a placeholder NODE_AUTH_TOKEN, which
+          # shadows OIDC trusted publishing (npm sees a token and skips the
+          # OIDC exchange → ENEEDAUTH/404). The committed root .npmrc already
+          # sets `registry=https://registry.npmjs.org`, so the registry is
+          # configured without the auth placeholder. See #245/#247.
 
       - name: Install dependencies
         run: npm ci

From 083e92541be004d844939b78577f1f2c3c60a8ce Mon Sep 17 00:00:00 2001
From: Automaker <automaker@localhost>
Date: Sun, 24 May 2026 23:15:12 -0700
Subject: [PATCH 2/3] ci(release): add temporary OIDC env diagnostic step

---
 .github/workflows/release.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f8326b95d..eab5a153b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,6 +87,18 @@ jobs:
         if: steps.version.outputs.already_tagged != 'true'
         run: npm run prepare:package
 
+      - name: Debug OIDC environment
+        if: steps.version.outputs.already_tagged != 'true'
+        run: |
+          echo "ACTIONS_ID_TOKEN_REQUEST_URL set? ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}${ACTIONS_ID_TOKEN_REQUEST_URL:-NO}"
+          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set? ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:+yes}${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-NO}"
+          echo "NODE_AUTH_TOKEN set? ${NODE_AUTH_TOKEN:+yes}${NODE_AUTH_TOKEN:-NO}"
+          npm install -g npm@latest >/dev/null 2>&1
+          echo "npm version: $(npm --version)"
+          echo "npm config registry: $(npm config get registry)"
+          echo "--- effective npmrc (auth lines redacted) ---"
+          npm config ls -l 2>/dev/null | grep -iE "registry|auth|provenance|//" | sed 's/_authToken=.*/_authToken=<redacted>/' || true
+
       - name: Publish to npm (OIDC trusted publisher)
         if: steps.version.outputs.already_tagged != 'true'
         working-directory: dist

From a5a47d7b76a400ad0f83b7b02c391644432f5c88 Mon Sep 17 00:00:00 2001
From: Automaker <automaker@localhost>
Date: Sun, 24 May 2026 23:29:45 -0700
Subject: [PATCH 3/3] ci(release): remove temporary OIDC diagnostic step

---
 .github/workflows/release.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eab5a153b..f8326b95d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,18 +87,6 @@ jobs:
         if: steps.version.outputs.already_tagged != 'true'
         run: npm run prepare:package
 
-      - name: Debug OIDC environment
-        if: steps.version.outputs.already_tagged != 'true'
-        run: |
-          echo "ACTIONS_ID_TOKEN_REQUEST_URL set? ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}${ACTIONS_ID_TOKEN_REQUEST_URL:-NO}"
-          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN set? ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:+yes}${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-NO}"
-          echo "NODE_AUTH_TOKEN set? ${NODE_AUTH_TOKEN:+yes}${NODE_AUTH_TOKEN:-NO}"
-          npm install -g npm@latest >/dev/null 2>&1
-          echo "npm version: $(npm --version)"
-          echo "npm config registry: $(npm config get registry)"
-          echo "--- effective npmrc (auth lines redacted) ---"
-          npm config ls -l 2>/dev/null | grep -iE "registry|auth|provenance|//" | sed 's/_authToken=.*/_authToken=<redacted>/' || true
-
       - name: Publish to npm (OIDC trusted publisher)
         if: steps.version.outputs.already_tagged != 'true'
         working-directory: dist