From 9a61c607ab5d552359c98d6e658677a600f80abe Mon Sep 17 00:00:00 2001
From: YeonGyu-Kim <code.yeon.gyu@gmail.com>
Date: Thu, 30 Apr 2026 16:27:35 +0900
Subject: [PATCH] fix(ci): treat npm OIDC exchange 201 as success in preflight

Empirically the npm registry returns HTTP 201 (Created) - not 200 -
when the OIDC token exchange succeeds and a fresh publish token is
issued. The preflight gate was only accepting 200 so every
correctly-configured package was flagged as missing. Accept any
2xx status; only treat 4xx/5xx as missing trust config.
---
 .github/workflows/publish.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 87f52aa84..fc50d007f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -102,7 +102,9 @@ jobs:
               -H "Content-Type: application/json" \
               -d '{}')
 
-            if [ "${STATUS}" = "200" ]; then
+            # npm returns 200 or 201 when trusted publisher is configured (token issued).
+            # 404 means the package has no trusted publisher mapping for this workflow.
+            if [ "${STATUS}" -ge 200 ] && [ "${STATUS}" -lt 300 ]; then
               echo "OK   ${pkg}"
             else
               echo "FAIL ${pkg} (HTTP ${STATUS})"