A credential in .npmrc is what stops OIDC — and setup-node writes one - #5
Merged
Conversation
… one
`registry-url` makes actions/setup-node write `_authToken=${NODE_AUTH_TOKEN}`
into an .npmrc. With no token to substitute, the line does not disappear - it
becomes an empty credential, and npm reads any `_authToken` line as auth being
configured. So it never performs the OIDC exchange, and fails as ENEEDAUTH or a
404: a configuration problem wearing a permissions problem's error message
(actions/setup-node#1551).
The rehearsal is what showed it - `NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX` in
the environment of a workflow that has no token and wants none.
`registry-url` is gone; npmjs.org is the default anyway. check-no-npm-auth.mjs
runs before the publish and fails on a credential in any .npmrc npm would read,
or on NODE_AUTH_TOKEN being set at all, so the next reintroduction fails loudly
instead of at the registry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The OIDC rehearsal passed, but its log showed this in the publish step's environment:
That is
actions/setup-node's placeholder, in a workflow that has no token and wants none. It would have broken the next release.What happens
Given a
registry-url, setup-node always writes_authToken=${NODE_AUTH_TOKEN}into an.npmrc. With no token to substitute, the line does not disappear — it becomes an empty credential rather than no credential. npm reads any_authTokenline as "auth is configured", so it never performs the OIDC exchange, and fails withENEEDAUTHor a 404.That error reads as a permissions problem and is not one — it is a configuration problem wearing a permissions problem's message. Documented at actions/setup-node#1551 and npm/documentation#1960.
Trusted publishing works by npm noticing it has no credentials. Handing it an empty one is worse than handing it none.
The fix
registry-urlis removed — npmjs.org is the default registry regardless, so nothing is lost.scripts/check-no-npm-auth.mjsthen runs before the publish and fails on a credential in any.npmrcnpm would read (NPM_CONFIG_USERCONFIG,~/.npmrc, the repo's own), or onNODE_AUTH_TOKENbeing set at all. Verified against all four states:.npmrcNODE_AUTH_TOKENset, no file~/.npmrc(this machine)The point is that the next reintroduction fails loudly in CI rather than at the registry, halfway through a release — which is how the last three attempts went.
Why this could not be caught by rehearsing
workflow_dispatch --dry-runruns the whole gate and publishes nothing, so it never authenticates. The first real exercise of OIDC auth is a real publish. That is exactly why this needed catching by reading, not by running.RELEASING.mdgains a section on the trap, and the changelog records it.