panates / rman / 36482718752

95%

main: 95%

push

github

fix(ci): setup-node needs registry-url, and dropping it is what answered ENEEDAUTH

40f41e3 left `registry-url` off `actions/setup-node` deliberately, and the
reasoning was correct for v4 and explicitly wrong for v7.

The worry was that `registry-url` makes setup-node write an `.npmrc` whose
`_authToken` is a dummy `NODE_AUTH_TOKEN` fallback, and that a placeholder token
would stop npm ever reaching for OIDC. v7 removed that fallback and says so in
its own breaking-changes note: "npm Trusted Publishing (OIDC) is not affected,
since it does not use NODE_AUTH_TOKEN". The official recipe under
docs/advanced-usage.md, "Publishing to npm with Trusted Publisher (OIDC)", sets
it - checkout, setup-node with `node-version: '24'` and
`registry-url: 'https://registry.npmjs.org'`, `npm ci`, `npm publish` - and the
release that ran without it answered

  npm error code ENEEDAUTH

with the trusted publisher already registered on the package.

Stated rather than claimed: this is a deviation from the documented recipe that
I introduced, and it is the most likely cause - not a proven one. The diagnostic
step added in 4a6e05a still reports the two facts that would point elsewhere
(an npm older than 11.5.1, or the id-token permission not reaching the job).

That step now reads both npmrc files rather than only `~/.npmrc`, since
setup-node writes a *project* one: with only the user check it would have
reported "OIDC is the only route" while a repo `.npmrc` sat beside it. Verified
by running the step's script verbatim.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2875 of 3157 branches covered (91.07%)

Branch coverage included in aggregate %.

17348 of 18328 relevant lines covered (94.65%)

195.7 hits per line