From 7db29bbb3a8a24c8f5082d0ad77096a184e3145c Mon Sep 17 00:00:00 2001 From: Josh Owens Date: Fri, 21 Aug 2026 21:31:09 -0400 Subject: [PATCH] ci: pin npm@11 for publish and log http traffic during npm publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm 12.0.2 with OIDC vars present still ENEEDAUTHed with no visible exchange attempt. Pin the battle-tested npm 11.x line for trusted publishing and add --loglevel http to the publish so the log shows whether an OIDC token exchange happens and what the registry answers — if 11.x also fails, the http trace separates 'npm never tried' from 'registry rejected the workflow identity' (a trusted-publisher registration mismatch). Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01GtAjJabU9hUkrzoWF3Xtzm --- .github/workflows/release.yml | 2 +- .releaserc.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a684a3c..1f01e01 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,7 @@ jobs: # config mismatch (must be repo queso/FlowSpec, workflow release.yml). - name: Update npm for trusted publishing run: | - npm install -g npm@latest + npm install -g npm@11 echo "node=$(node --version) npm=$(npm --version)" if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then echo "OIDC vars: present" diff --git a/.releaserc.json b/.releaserc.json index 4671557..abf0d31 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -12,7 +12,7 @@ [ "@semantic-release/exec", { - "publishCmd": "npm publish --provenance --access public" + "publishCmd": "npm publish --provenance --access public --loglevel http" } ], "@semantic-release/github",