Repository navigation
ci(publish): remove registry-url from setup-node to fix OIDC auth - #1088
Merged
Merged
Conversation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
- Changelog: add v3.0.0-beta.28 entry (2FA, GraphQL, fixes) - Authentication: add Two-Factor Authentication (TOTP) section - Plugins: add Two-Factor Auth and GraphQL plugin entries - Plugin registry: regenerate from manifests (defaultActive fix) 🤖 Generated with [Claude Code](https://claude.com/claude-code)
…a tag step Remove NPM_TOKEN secret dependency — OIDC (id-token: write + npm trusted publisher) handles auth. Add `environment: npm` to gate workflow on the npm trusted publisher connection. Add beta dist-tag step post-publish. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
npm install on macOS after version:beta stripped Linux optional packages (esbuild Linux binary, emnapi), breaking npm ci. Full delete-and-reinstall restores cross-platform entries per CLAUDE.md lock file trap guidance. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
setup-node with registry-url injects NODE_AUTH_TOKEN into .npmrc; when the token is empty, npm sends unauthenticated requests and gets 404 on PUT. Removing registry-url lets npm use the OIDC provenance token directly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
setup-nodewithregistry-urlinjectsNODE_AUTH_TOKENinto.npmrc. When no token is provided (OIDC-only flow), npm sends unauthenticated requests and gets 404 on PUT.Removing
registry-urllets npm discover the OIDC token directly via--provenanceand the trusted publisher connection.🤖 Generated with Claude Code