publish: print OIDC claims to debug trusted publisher matching

.github/workflows/publish.yml

@@ -67,7 +67,14 @@ jobs:
             npm version --no-git-tag-version "${V%%-*}-dev.${{ github.run_number }}"
           fi
           echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV"
+      - name: show OIDC claims npm will see
+        run: |
+          T=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=npm:registry.npmjs.org" | node -p "JSON.parse(require('fs').readFileSync(0)).value")
+          echo "$T" | cut -d. -f2 | base64 -d 2>/dev/null | node -p "
+            const c = JSON.parse(require('fs').readFileSync(0));
+            ['repository','repository_owner','workflow_ref','job_workflow_ref','environment','event_name','ref','aud']
+              .map(k => k + ': ' + JSON.stringify(c[k])).join('\n')"
       - run: |
           npm --version
-          echo "OIDC request url present: ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}"
           npm publish --access public --tag "$CHANNEL" --loglevel http