From 35edb8b754e188cc2b6bcfc83db373b8852b0450 Mon Sep 17 00:00:00 2001
From: Riccardo Cipolleschi <cipolleschi@meta.com>
Date: Wed, 8 Jul 2026 15:02:12 +0200
Subject: [PATCH] chore(release): add OIDC availability diagnostic step

Prints whether ACTIONS_ID_TOKEN_REQUEST_URL is present to determine if GitHub is actually granting id-token: write. Presence only, never the value.
---
 .github/workflows/release.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fde084e..f43d53c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -45,6 +45,16 @@ jobs:
           # publishing (OIDC) only activates when NO auth token is configured, so
           # configuring a token would make `npm publish` skip OIDC entirely.
           # The default registry is already https://registry.npmjs.org/.
+      - name: Debug OIDC availability
+        # GitHub only injects ACTIONS_ID_TOKEN_REQUEST_URL when `id-token: write`
+        # is actually granted. Prints presence only (never the value/token).
+        run: |
+          if [ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "OIDC id-token IS available -> id-token: write is granted, OIDC can run."
+          else
+            echo "OIDC id-token is NOT available (ACTIONS_ID_TOKEN_REQUEST_URL is empty)."
+            echo "=> GitHub is not granting id-token: write for this run."
+          fi
       - name: Determine new template version
         run: echo "VERSION=$(./scripts/bumpedTemplateVersion.sh ${{ inputs.version }})" >> $GITHUB_ENV
       - name: Update versions to input one