Fix npm trusted publishing and remove redundant test step #99
Conversation
npm trusted publishing with OIDC requires npm v11.5.1+, which ships with Node.js 24. Node 22 includes npm v10 which doesn't properly handle OIDC token exchange for authentication, causing "Access token expired" errors despite correct configuration.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a1ecdf1aa2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - run: pnpm install --frozen-lockfile | ||
| - run: pnpm test | ||
| - run: npm publish --provenance --access public |
There was a problem hiding this comment.
In the tag publish job, pnpm test was the only step that ran pnpm build, and the repo doesn’t check in dist. With the test step removed, the workflow now goes straight from pnpm install to npm publish, so the package is published without compiled dist artifacts even though package.json’s main/bin and files depend on dist. This will produce a broken package on npm for tag pushes; add an explicit build step (or restore a step that runs pnpm build) before publishing.
Useful? React with 👍 / 👎.
Summary
pnpm teststep from publish workflow (tests already run on PR merge)Why
Publishing was failing with "Access token expired" / 404 errors despite correct trusted publisher configuration. The root cause is that npm trusted publishing with OIDC requires npm v11.5.1+, which ships with Node.js 24. Node 22 includes npm v10 which doesn't properly handle the OIDC token exchange for authentication.
Reference: https://medium.com/@kenricktan11/npm-trusted-publishers-the-weird-404-error-and-the-node-js-24-fix-a9f1d717a5dd