From 8912d8821a385b5faa1a37de10b365f58251eb4d Mon Sep 17 00:00:00 2001
From: Christian Findlay <16697547+MelbourneDeveloper@users.noreply.github.com>
Date: Sat, 6 Jun 2026 18:48:20 +1000
Subject: [PATCH] Fix npm publish E404: drop setup-node registry-url so OIDC
 trusted publishing runs

---
 .github/workflows/release.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ea0ca72..f2b4b3d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,10 +31,15 @@ jobs:
           toolchain: stable
           components: rustfmt, clippy, llvm-tools-preview
 
+      # NO registry-url here. setup-node's registry-url writes an .npmrc with
+      # `_authToken=${NODE_AUTH_TOKEN}` and defaults NODE_AUTH_TOKEN to a
+      # placeholder; npm then auth's with that bogus token instead of running
+      # OIDC trusted publishing, and the registry rejects the PUT with E404.
+      # Omitting registry-url leaves no .npmrc token, so npm >= 11.5.1 performs
+      # the OIDC exchange against the configured Trusted Publisher. [SWR-SEC-OIDC-PUBLISH]
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
-          registry-url: 'https://registry.npmjs.org'
 
       # npm OIDC trusted publishing requires npm >= 11.5.1 (action ships older).
       - name: Upgrade npm to OIDC-capable release