From fd85dad98490c75f2b3cf55947857bc2b5a69c97 Mon Sep 17 00:00:00 2001 From: YeonGyu-Kim Date: Thu, 30 Apr 2026 15:19:43 +0900 Subject: [PATCH] fix(ci): strip _authToken from .npmrc so OIDC takes precedence After switching to npm Trusted Publishing the publish step still returned 'PUT 404' because actions/setup-node injects an '//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}' line into .npmrc. With NODE_AUTH_TOKEN unset that placeholder evaluates to an empty string, so npm tries an empty token before reaching for the OIDC ID token and the registry rejects it. - Add a step that strips any _authToken line from both project- local and $HOME/.npmrc before publishing, so npm CLI proceeds to OIDC token exchange. - Bump publish commands to --loglevel verbose so future failures expose the actual auth path (provenance attestation, OIDC exchange, etc.) in workflow logs. --- .github/workflows/publish-platform.yml | 19 +++++++++++++++---- .github/workflows/publish.yml | 19 +++++++++++++++---- 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml index 5d95c494a..7d4b5a8e7 100644 --- a/.github/workflows/publish-platform.yml +++ b/.github/workflows/publish-platform.yml @@ -352,6 +352,17 @@ jobs: if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success' run: npm install -g npm@latest + - name: Strip token auth from .npmrc to force OIDC + if: steps.check.outputs.skip_all != 'true' && steps.download.outcome == 'success' + run: | + for f in .npmrc "$HOME/.npmrc"; do + if [ -f "$f" ]; then + sed -i.bak '/_authToken/d' "$f" + rm -f "$f.bak" + echo "Cleaned $f" + fi + done + - name: Publish oh-my-opencode-${{ matrix.platform }} if: steps.check.outputs.skip_opencode != 'true' && steps.download.outcome == 'success' env: @@ -361,9 +372,9 @@ jobs: cd packages/${{ matrix.platform }} if [ -n "$DIST_TAG" ]; then - npm publish --access public --provenance --tag "$DIST_TAG" + npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose else - npm publish --access public --provenance + npm publish --access public --provenance --loglevel verbose fi timeout-minutes: 15 @@ -382,8 +393,8 @@ jobs: package.json > tmp.json && mv tmp.json package.json if [ -n "$DIST_TAG" ]; then - npm publish --access public --provenance --tag "$DIST_TAG" + npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose else - npm publish --access public --provenance + npm publish --access public --provenance --loglevel verbose fi timeout-minutes: 15 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index d53da6f1f..4d394f528 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -169,6 +169,17 @@ jobs: bunx tsc --emitDeclarationOnly bun run build:schema + - name: Strip token auth from .npmrc to force OIDC + if: steps.check.outputs.skip != 'true' + run: | + for f in .npmrc "$HOME/.npmrc"; do + if [ -f "$f" ]; then + sed -i.bak '/_authToken/d' "$f" + rm -f "$f.bak" + echo "Cleaned $f" + fi + done + - name: Publish oh-my-opencode if: steps.check.outputs.skip != 'true' env: @@ -176,9 +187,9 @@ jobs: NPM_CONFIG_PROVENANCE: true run: | if [ -n "$DIST_TAG" ]; then - npm publish --access public --provenance --tag "$DIST_TAG" + npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose else - npm publish --access public --provenance + npm publish --access public --provenance --loglevel verbose fi - name: Check if oh-my-openagent already published @@ -213,9 +224,9 @@ jobs: ' package.json > tmp.json && mv tmp.json package.json if [ -n "$DIST_TAG" ]; then - npm publish --access public --provenance --tag "$DIST_TAG" + npm publish --access public --provenance --tag "$DIST_TAG" --loglevel verbose else - npm publish --access public --provenance + npm publish --access public --provenance --loglevel verbose fi - name: Restore package.json