Skip to content

Remove setup-node token fallback from npm OIDC - #23

Merged
chh-ay merged 1 commit into
developfrom
fix/restore-oidc-registry
Jul 19, 2026
Merged

Remove setup-node token fallback from npm OIDC#23
chh-ay merged 1 commit into
developfrom
fix/restore-oidc-registry

Conversation

@chh-ay

@chh-ay chh-ay commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Changes

  • retain the explicit npm registry configuration
  • remove setup-node's generated token fallback before trusted publication
  • unset the dummy token for the publisher process so npm can exchange GitHub OIDC credentials
  • lock the tokenless registry path into workflow contracts

Evidence

  • removing registry configuration returned ENEEDAUTH before trusted publishing
  • setup-node writes an _authToken fallback whenever registry-url is configured
  • the cleanup command preserves the registry and removes only _authToken
  • 15 focused workflow tests and Biome passed

@vercel

vercel Bot commented Jul 19, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
sheetwrite Ready Ready Preview, Comment Jul 19, 2026 2:14pm

@chh-ay
chh-ay force-pushed the fix/restore-oidc-registry branch from be2606b to a411352 Compare July 19, 2026 14:04
@chh-ay chh-ay changed the title Restore npm registry configuration for OIDC Remove setup-node token fallback from npm OIDC Jul 19, 2026
@chh-ay
chh-ay merged commit ad40c1e into develop Jul 19, 2026
11 checks passed
@chh-ay
chh-ay deleted the fix/restore-oidc-registry branch July 19, 2026 14:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@chh-ay