From 14894c2c7da5fb4705acab91ccdc22c4fae530c7 Mon Sep 17 00:00:00 2001
From: Juan Leni <juan.leni@zondax.ch>
Date: Sat, 20 Jun 2026 18:03:55 +0200
Subject: [PATCH] fix(npm): correct OIDC diagnostic + document
 trusted-publishing limitation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'Debug OIDC environment' step read ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN via
${{ env.* }}, which never sees runner-injected vars and always printed 'false'
— a misleading red herring while debugging publish failures. Read them from the
shell instead, and print github.job_workflow_ref (the claim npm actually checks)
rather than the empty job_workflow_sha.

Also document, in the header, that npm OIDC trusted publishing cannot work
through a reusable workflow (npm matches job_workflow_ref = this file, which a
per-package trusted publisher can't name) — so packages must publish in their
own workflow. Verified end-to-end with @zondax/cli.
---
 .github/workflows/_publish-npm.yaml | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/_publish-npm.yaml b/.github/workflows/_publish-npm.yaml
index f9d05ec..c4a20df 100644
--- a/.github/workflows/_publish-npm.yaml
+++ b/.github/workflows/_publish-npm.yaml
@@ -1,7 +1,16 @@
 name: Reusable Publish NPM
 
-# Uses OIDC Trusted Publishing - no tokens needed
-# Configure trusted publisher on npmjs.com for your package
+# ⚠️ npm OIDC Trusted Publishing does NOT work through this reusable workflow.
+# npm validates the OIDC `job_workflow_ref` claim, which for a reusable workflow
+# is THIS file (zondax/_workflows/.github/workflows/_publish-npm.yaml) — not the
+# caller's workflow. A package's Trusted Publisher can only name one repo +
+# workflow (e.g. Zondax/cli + publish-npm.yaml), so a publish performed here can
+# never match it and npm returns `E404 ... is not in this registry`.
+# (Verified: @zondax/cli only published once its publish ran in its OWN workflow.)
+#
+# To publish to npm with OIDC, run `npm publish` in the package repo's own
+# workflow (see Zondax/cli/.github/workflows/publish-npm.yaml). This workflow is
+# still usable for token-based publishing if a token is wired in.
 # See: https://docs.npmjs.com/trusted-publishers/
 
 on:
@@ -154,14 +163,21 @@ jobs:
           node --version
           echo ""
           echo "=== OIDC Token Info ==="
-          echo "ACTIONS_ID_TOKEN_REQUEST_URL is set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_URL != '' }}"
-          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN is set: ${{ env.ACTIONS_ID_TOKEN_REQUEST_TOKEN != '' }}"
+          # NOTE: read these from the shell, NOT `${{ env.* }}`. The `env`
+          # context only exposes variables declared via `env:` blocks; the
+          # runner-injected OIDC vars are not in it, so `${{ env.ACTIONS_ID_TOKEN_REQUEST_URL }}`
+          # always evaluates to empty and prints a misleading "false".
+          echo "ACTIONS_ID_TOKEN_REQUEST_URL is set: $([ -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] && echo true || echo false)"
+          echo "ACTIONS_ID_TOKEN_REQUEST_TOKEN is set: $([ -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ] && echo true || echo false)"
           echo ""
           echo "=== GitHub Context ==="
           echo "Repository: ${{ github.repository }}"
           echo "Workflow: ${{ github.workflow }}"
+          # workflow_ref = entry-point (caller) workflow; job_workflow_ref = the
+          # workflow that actually contains this job (THIS reusable file). npm
+          # trusted publishing matches on job_workflow_ref — see the header note.
           echo "Workflow ref: ${{ github.workflow_ref }}"
-          echo "Job workflow ref: ${{ github.job_workflow_sha }}"
+          echo "Job workflow ref: ${{ github.job_workflow_ref }}"
           echo "Run ID: ${{ github.run_id }}"
 
       - name: Publish package