panates / rman / 36483573275

95%

main: 95%

push

github

ci: the diagnostic reads the npmrc npm actually uses, not the one beside the checkout

It reported `repo npmrc: none - setup-node wrote nothing`, which was its own
mistake: setup-node v7 writes the file to a temp path and points
`NPM_CONFIG_USERCONFIG` at it, which every step's env in the log shows as
`/home/runner/work/_temp/.npmrc`. The check looked at `./.npmrc` and concluded
nothing had been written.

That matters because of what the file might contain. With `registry-url` set,
setup-node has historically written `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`,
and an unset variable expands to an empty token - which npm can read as "I have
credentials" and never reach for OIDC at all. That is the exact shape of the
failure now in the log: a 404 on a package we own, which npm returns instead of
403 so the registry does not leak whether a package exists, and which means the
registry never established who we are.

Prints, with every `_authToken` redacted: whether NODE_AUTH_TOKEN is set at all,
and the contents of both the userconfig npm resolves and any `./.npmrc`.
Verified by running the step's script verbatim, against a real ~/.npmrc that has
two auth lines - both came out REDACTED.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2893 of 3175 branches covered (91.12%)

Branch coverage included in aggregate %.

17348 of 18328 relevant lines covered (94.65%)

195.73 hits per line