fix(npm): correct OIDC diagnostic + document trusted-publishing limitation - #103
Merged
Conversation
…ation
The 'Debug OIDC environment' step read ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN via
${{ env.* }}, which never sees runner-injected vars and always printed 'false'
— a misleading red herring while debugging publish failures. Read them from the
shell instead, and print github.job_workflow_ref (the claim npm actually checks)
rather than the empty job_workflow_sha.
Also document, in the header, that npm OIDC trusted publishing cannot work
through a reusable workflow (npm matches job_workflow_ref = this file, which a
per-package trusted publisher can't name) — so packages must publish in their
own workflow. Verified end-to-end with @zondax/cli.
jleni
added a commit
that referenced
this pull request
Jun 20, 2026
…able workflow) (#104) * docs(npm): correct trusted-publishing guidance — it DOES work via reusable workflow #103 wrongly stated OIDC trusted publishing can't work through this reusable workflow. It does: many @Zondax packages (casper/filecoin/substrate/...) publish via it with OIDC and no token. The real requirement is that the package's npm Trusted Publisher must use Workflow filename '_publish-npm.yaml' (this file = the job_workflow_ref npm matches), NOT the caller's workflow filename. @zondax/cli failed only because its Trusted Publisher named 'publish-npm.yaml' (its caller). Correct the header to give the right configuration. * docs(npm): align trusted-publisher guidance with npm's documented behavior Per npm docs, for reusable/workflow_call publishing the Trusted Publisher's Workflow filename must be the CALLER's workflow (not this file), and npm flags this path as finicky ('checks the calling workflow's name ... can cause configuration mismatches'). Recommend self-contained publish as the reliable fallback. Corrects my earlier '_publish-npm.yaml' guidance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
@zondax/clireleases kept failing withnpm error E404 ... '@zondax/cli@x.y.z' is not in this registrywhen publishing through_publish-npm.yaml, despite a correctly-configured npm Trusted Publisher. This PR fixes the misleading diagnostic that sent us down the wrong path, and documents the underlying limitation (now verified).What this PR changes (safe, non-behavioral)
Debug OIDC environmentread${{ env.ACTIONS_ID_TOKEN_REQUEST_URL }}/_TOKEN. Theenvcontext only exposesenv:-declared vars, not runner-injected OIDC vars — so it always printedis set: false, even when the token was present. We chased a phantom "no OIDC token" for hours because of this. Now read from the shell ([ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ]).github.job_workflow_ref(the claim npm actually validates) instead of the emptygithub.job_workflow_sha.The real finding (verified)
npm trusted publishing validates the OIDC
job_workflow_ref— the workflow file that runsnpm publish. For a reusable workflow that's this file (zondax/_workflows/.github/workflows/_publish-npm.yaml), not the caller. A package's Trusted Publisher can only name one repo + workflow (e.g.Zondax/cli·publish-npm.yaml), so a publish performed here can never match it →E404.Proof:
@zondax/clifailed every publish through this reusable workflow (v7 and v10), then published successfully (1.14.1) the moment itsnpm publishran in its own repo workflow (Zondax/cli/.github/workflows/publish-npm.yaml) withid-token: write.OIDC vs token — strategy options (org decision)
npm publishin its own workflow withid-token: write; keep OIDC trusted publishing (no tokens).Zondax/clialready does this.npm_tokensecret input here and auth withNODE_AUTH_TOKEN.Recommendation: A. I'm happy to add a documented self-contained
publish-npm.yamltemplate (mirroring cli's) and either deprecate npm publishing from this reusable workflow or gate it behind a token input — your call.🤖 Generated with Claude Code