Skip to content

Comments

Fix: Remove registry-url to enable OIDC authentication#69

Merged
alexpmule merged 2 commits intomainfrom
fix/npm-trusted-publishers-oidc
Jan 6, 2026
Merged

Fix: Remove registry-url to enable OIDC authentication#69
alexpmule merged 2 commits intomainfrom
fix/npm-trusted-publishers-oidc

Conversation

@alexpmule
Copy link
Contributor

@alexpmule alexpmule commented Jan 6, 2026

Fix: Remove registry-url to Enable OIDC Authentication

Problem

NPM publish was failing with 404 errors despite OIDC/Provenance being configured correctly:

✅ npm notice publish Signed provenance statement with source and build information from GitHub Actions
✅ npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=798534347
❌ npm notice Access token expired or revoked. Please try logging in again.
❌ npm error 404 Not Found - PUT https://registry.npmjs.org/@api-components%2fapi-navigation

Root Cause

The registry-url parameter in setup-node@v4 creates a .npmrc file that blocks OIDC authentication.

Solution

Removed registry-url from setup-node configuration to allow pure OIDC authentication via NPM Trusted Publishers.

@alexpmule alexpmule self-assigned this Jan 6, 2026
@alexpmule alexpmule merged commit 984146f into main Jan 6, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants