fix(ci): enable tokenless npm OIDC publish for v0.1.2

* fix(ci): let npm use OIDC instead of empty setup-node auth token

* chore: prepare v0.1.2 for OIDC validation

* docs: use v0.1.2 in OIDC release example

Author: splincode

.github/workflows/publish.yml

@@ -84,7 +84,6 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
-          registry-url: https://registry.npmjs.org
           package-manager-cache: false
 
       - name: Require OIDC-compatible npm
@@ -103,7 +102,21 @@ jobs:
             }
           '
 
+      # OIDC requires no authentication token in npm config. Supplying
+      # registry-url to setup-node writes a classic _authToken placeholder,
+      # which can prevent npm from starting its OIDC exchange.
+      - name: Verify OIDC credentials are available
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}"
+          test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}"
+          if [[ -n "${NODE_AUTH_TOKEN:-}" || -n "${NPM_TOKEN:-}" ]]; then
+            echo "Unexpected npm token environment variable; OIDC must be used" >&2
+            exit 1
+          fi
+
       # No npm install or dependency scripts in the OIDC-enabled job.
       # npm automatically generates provenance for public packages.
       - name: Publish to npm via OIDC
-        run: npm publish --access public --ignore-scripts
+        run: npm publish --access public --ignore-scripts --registry=https://registry.npmjs.org/

README.md

@@ -82,13 +82,13 @@ Keep the version in `package.json` synchronized with the first published version
 
 ### Publish the next version
 
-Update `package.json` to an unpublished version (for example, `0.1.1`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:
+Update `package.json` to an unpublished version (for example, `0.1.2`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:
 
 ```sh
 git switch main
 git pull --ff-only
-git tag v0.1.1
-git push origin v0.1.1
+git tag v0.1.2
+git push origin v0.1.2
 ```
 
 The [publish workflow](./.github/workflows/publish.yml) verifies the exact version and that the tag commit is on `main`, runs tests without OIDC permissions, and publishes in a separate approval-gated environment. The publisher job disables npm lifecycle scripts and uses npm's short-lived OIDC authentication and automatic provenance. Pinned GitHub Action commit SHAs and disabled release-job caching reduce supply-chain risk.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "prettier-plugin-angular-comment",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Format Angular templates in JS/TS template literals with /* Angular */",
   "type": "module",
   "exports": {