From b218ba367e25ab19034f4fc9423dd9191effbdbe Mon Sep 17 00:00:00 2001 From: only-cli Date: Tue, 18 Aug 2026 09:54:51 -0400 Subject: [PATCH] publish: print OIDC claims to debug trusted publisher matching --- .github/workflows/publish.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 9a6e02d..5229354 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -67,7 +67,14 @@ jobs: npm version --no-git-tag-version "${V%%-*}-dev.${{ github.run_number }}" fi echo "CHANNEL=$CHANNEL" >> "$GITHUB_ENV" + - name: show OIDC claims npm will see + run: | + T=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ + "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=npm:registry.npmjs.org" | node -p "JSON.parse(require('fs').readFileSync(0)).value") + echo "$T" | cut -d. -f2 | base64 -d 2>/dev/null | node -p " + const c = JSON.parse(require('fs').readFileSync(0)); + ['repository','repository_owner','workflow_ref','job_workflow_ref','environment','event_name','ref','aud'] + .map(k => k + ': ' + JSON.stringify(c[k])).join('\n')" - run: | npm --version - echo "OIDC request url present: ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}" npm publish --access public --tag "$CHANNEL" --loglevel http