Drop registry-url so npm actually runs the OIDC exchange#7
Merged
Conversation
The 3.0.0 publish run passed all five gates, signed a provenance statement,
and then died with `E403 Forbidden - PUT /simple-builder`. The log contains
no OIDC or trusted-publishing lines at all: npm never attempted the token
exchange and issued the PUT unauthenticated.
npm runs the exchange only when it finds no usable credential for the
registry, and `registry-url` makes setup-node write
`_authToken=${NODE_AUTH_TOKEN}` into an .npmrc unconditionally. Whether that
line is harmless turns entirely on how the variable expands:
- undefined (no `env:` at all) — the line survives as the literal string
`${NODE_AUTH_TOKEN}`, which reads as a credential and suppresses OIDC
- empty string (`env:` naming a secret that does not exist) — expands to an
empty credential, npm falls through to OIDC and publishes
The sibling repo await-parallel-limit publishes with provenance and no
secrets on the second spelling, which is what confirmed the mechanism.
Removing the `env:` block, as the previous commit did, moved us onto the
first — so that change is what turned a working configuration into a 403.
Omit registry-url instead: it removes the question rather than depending on
an expansion rule, and npm defaults to registry.npmjs.org regardless. See
actions/setup-node#1551.
Add a guard step before publish that strips any _authToken line and asserts
no credential is configured, never echoing the value. Without it this class
of failure only surfaces as an opaque 403 at the very end, which reads like
an npmjs.com permissions problem rather than a runner config one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v3.0.0 publish run passed all five gates, signed a provenance statement, then died with
E403 Forbidden - PUT /simple-builder. The log contains no OIDC or trusted-publishing lines at all — npm never attempted the token exchange and issued thePUTunauthenticated.Mechanism
npm runs the OIDC exchange only when it finds no usable credential for the registry.
registry-urlmakessetup-nodewrite_authToken=${NODE_AUTH_TOKEN}into an.npmrcunconditionally, so whether that line is harmless turns entirely on how the variable expands:NODE_AUTH_TOKEN.npmrcline becomesenv:block)${NODE_AUTH_TOKEN}env:naming a nonexistent secret)The sibling repo
await-parallel-limitpublishes with provenance and no repo secrets on the second spelling, which is what confirmed the mechanism. #6 removed theenv:block and thereby moved this repo onto the first — that change is what turned a working configuration into a 403.Fix
Omit
registry-urlentirely. That removes the question rather than depending on an expansion rule, and npm defaults toregistry.npmjs.orgregardless. See actions/setup-node#1551.Adds a guard step immediately before publish that strips any
_authTokenline and asserts no credential is configured — without echoing the value into the public log. Otherwise this class of failure only appears as an opaque 403 at the very end, after ~5 minutes of gates, looking like an npmjs.com permissions problem rather than a runner config one.AGENTS.mdrecords both spellings, and thatnpm install -g npm@latestis load-bearing: Node 22 ships npm 10, which has no OIDC support and fails withENEEDAUTH— the errorawait-parallel-limithit on its own first release attempt.No source or test changes.
🤖 Generated with Claude Code