Skip to content

chore(cd): clear the placeholder npm token so trusted publishing works #536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ShaneK merged 1 commit into from
Aug 19, 2026
Merged

chore(cd): clear the placeholder npm token so trusted publishing works #536

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,15 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# `lerna publish` uploads via libnpmpublish@4, which supports neither provenance nor
# OIDC trusted publishing, so the upload goes through the npm CLI instead.
#
# NODE_AUTH_TOKEN is cleared on purpose. `setup-node` exports the placeholder
# `XXXXX-XXXXX-XXXXX-XXXXX` when given no token, and the .npmrc it writes points
# `_authToken` at that variable, so npm sends the placeholder as a real credential
# and never attempts the OIDC exchange. The registry masks the rejection as E404.
# With no credential configured, npm falls back to trusted publishing.
- name: 🚀 Publish
run: npm run publish:ci
shell: bash
env:
NODE_AUTH_TOKEN: ''

Loading