ci: stop setup-node writing the empty auth token that broke OIDC - #311
Merged
Conversation
The v0.24.3 publish failed with E404 and I read it as a missing trusted
publisher on npmjs.com. It was this file.
`registry-url` makes setup-node write
//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}
into an .npmrc. That is right for token auth and quietly fatal under trusted
publishing: with no NODE_AUTH_TOKEN the line resolves to an empty token, npm
believes it already has credentials, and never attempts the OIDC exchange. The
registry answers the unauthenticated PUT with E404 — an error naming neither
OIDC nor trusted publishing, which is what sent me looking at the registry
config rather than at the workflow. actions/setup-node#1551, and npm/cli#9088
tracks the misleading diagnostics.
Dropping registry-url writes no .npmrc, and npm defaults to
registry.npmjs.org, which is where we publish.
Also:
- node 24 rather than 22, which bundles npm 11 and has been reported to settle
OIDC handshakes that 22 did not. The npm floor check stays, so this does not
depend on what a runner image ships.
- `--provenance` back on the publish. npm documents it as automatic under
trusted publishing but reports disagree; asking explicitly cannot give a
weaker result, and it is what v0.24.2 published with.
- the header now separates the two causes of that E404 instead of asserting the
wrong one.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan92 finding(s) HIGH/CRITICAL: 50 | MEDIUM: 42
…and 42 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v0.24.3 failure was this file, not npmjs.com
I read the E404 as a missing trusted publisher. It wasn't.
registry-urlmakesactions/setup-nodewriteinto an
.npmrc. That is correct for token auth and quietly fatal under trusted publishing: with noNODE_AUTH_TOKENthe line resolves to an empty token, npm believes it already has credentials, and never attempts the OIDC exchange at all. The registry answers the unauthenticated PUT with E404 — an error naming neither OIDC nor trusted publishing.The evidence was in the logs the whole time: the v0.24.1 token run logged
Signed provenance statement…before its E422, while the v0.24.3 OIDC run has no such line. No exchange was ever attempted.Known issue: actions/setup-node#1551. npm tracks the misleading diagnostics in npm/cli#9088.
Changes
registry-url— no.npmrcis written, and npm defaults toregistry.npmjs.org, which is where we publish--provenancerestored — npm documents it as automatic under trusted publishing, but reports disagree; asking explicitly cannot give a weaker result, and it's what v0.24.2 published withVerification
registry-urlconfirmed absent; zerosecrets.referencesMain is already at 0.24.3 and unpublished, so a plain dispatch tests this for real — no new release needed. If it still fails, the registration genuinely is missing and
NPM_TOKEN(still set, and proven by v0.24.2) is one revert away.🤖 Generated with Claude Code