From 6c8c09ac116e611be2edee263eb8c1aefedbc275 Mon Sep 17 00:00:00 2001 From: Bugs5382 Date: Mon, 7 Sep 2026 11:50:55 -0400 Subject: [PATCH] fix(ci): stop the publish job presenting a placeholder credential setup-node writes `_authToken=${NODE_AUTH_TOKEN}` into the job's .npmrc when given a registry-url, and exports a placeholder value when nothing supplies one. npm presented that placeholder and failed with ENEEDAUTH instead of falling back to the OIDC exchange trusted publishing relies on, which is how the v1.0.0 publish failed. Bind NODE_AUTH_TOKEN to the same secret the action's token input uses: a real token authenticates as before, and no token resolves empty, which is the condition under which npm reaches for OIDC. --- .github/workflows/action-deploy-npm.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/action-deploy-npm.yaml b/.github/workflows/action-deploy-npm.yaml index 64133f8..fccf5f9 100644 --- a/.github/workflows/action-deploy-npm.yaml +++ b/.github/workflows/action-deploy-npm.yaml @@ -38,8 +38,18 @@ jobs: # token to install this. - name: Publish to npm uses: JS-DevTools/npm-publish@v4 + env: + # setup-node writes `_authToken=${NODE_AUTH_TOKEN}` into the job's + # .npmrc and exports a placeholder value when nothing supplies one. + # npm then presents that placeholder as a credential and fails with + # ENEEDAUTH rather than falling back to the OIDC exchange trusted + # publishing relies on. Binding it to the secret keeps a real token + # working while leaving it empty when there is none, which is what + # lets npm reach for OIDC. + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} with: provenance: true access: public ignore-scripts: true + # Not required with trusted publishing; empty falls through to OIDC. token: ${{ secrets.NPM_TOKEN }}