From 4907740b64d040d9d38de6904205f59a7947443b Mon Sep 17 00:00:00 2001 From: darkobas Date: Tue, 18 Aug 2026 15:22:28 +0200 Subject: [PATCH] fix(ci): publish with the npm CLI so OIDC trusted publishing works The 0.1.0 publish failed with `404 Not Found - PUT` even though the npm trusted publisher record (ethersphere/core-sdk, publish_npmjs.yml, environment publish) is correct and provenance signing succeeded. Cause is in the runner env, visible in the failed run's log: NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX setup-node's `registry-url` always writes an .npmrc containing //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}. With no token supplied, NODE_AUTH_TOKEN is that literal placeholder. npm >= 11.5.1 detects that OIDC is available and replaces it with a real trusted-publishing token; pnpm 10.29.2 sent the placeholder verbatim, and the registry answers 404 on PUT rather than 401/403 so as not to leak whether a package exists. So this was never a permissions problem -- it was an unauthenticated request wearing a placeholder token. Switches the publish step to `npm publish` and bumps the job to node 24, which is what pins npm to 11.x. That is exactly how swarm-cli publishes. pnpm still handles install and build; only the publish call changes. Note this is NOT pnpm/pnpm#11513 (OIDC broken in pnpm 11) -- that regression is in 11.0.8 and this ran 10.29.2. --- .github/workflows/publish_npmjs.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish_npmjs.yml b/.github/workflows/publish_npmjs.yml index 064d36d..00e40d5 100644 --- a/.github/workflows/publish_npmjs.yml +++ b/.github/workflows/publish_npmjs.yml @@ -23,12 +23,24 @@ jobs: - name: Setup Node uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 cache: pnpm registry-url: 'https://registry.npmjs.org' - name: Install dependencies run: pnpm install --frozen-lockfile + # Publish with the npm CLI, NOT `pnpm publish`. + # + # setup-node's `registry-url` writes an .npmrc containing + # //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}, and with no token + # supplied NODE_AUTH_TOKEN is the literal placeholder XXXXX-XXXXX-XXXXX-XXXXX. + # npm >= 11.5.1 notices OIDC is available and overrides that placeholder with + # a real trusted-publishing token; pnpm 10.29.2 sent the placeholder as-is and + # the registry answered `404 PUT` -- npm's masked "not authorised". + # + # Node 24 is what pins npm to 11.x. This mirrors swarm-cli, which publishes + # this way successfully. pnpm still does install/build above; only the + # publish call changes. - name: Publish - run: pnpm publish --provenance --access public --no-git-checks + run: npm publish --provenance --access public