From aee0a2e8173a1dceec7ab0dbae96da3aaf7caa9d Mon Sep 17 00:00:00 2001 From: Suprhimp Date: Thu, 2 Jul 2026 14:56:12 +0900 Subject: [PATCH] ci: drop registry-url so OIDC trusted publishing isn't shadowed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup-node's registry-url writes a placeholder _authToken into .npmrc, which npm uses instead of OIDC — causing E404 on publish. Trusted Publishing requires no token in .npmrc; the default registry is registry.npmjs.org anyway. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index eb3c0b0..6a45f25 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,11 +22,12 @@ jobs: with: fetch-depth: 0 + # No registry-url: it writes a placeholder _authToken into .npmrc that + # shadows OIDC. Trusted Publishing needs NO token in .npmrc. - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: 24 - registry-url: https://registry.npmjs.org # Trusted Publishing (OIDC) requires npm >= 11.5.1. - name: Upgrade npm