Trusted Publisher documentation

[jasonkarns]

Description:
Document an example of how publishing to npm is handled if using npm's Trusted Publisher setup. In particular, explicitly answer the question whether NODE_AUTH_TOKEN needs to be set at all if using Trusted Publisher. (Presumably no?)

Justification:
Npm is pushing folks towards Trusted Publisher setup and away from token auth. This action should acknowledge that reality and document an example of what is necessary (or not necessary!) when using Trusted Publisher. Presently, there isn't so much as a mention of Trusted Publisher setup or configuration impact.

Are you willing to submit a PR?

[v-priyagupta108]

Hello @jasonkarns,
Thank you for this feature request. We will investigate it and get back to you as soon as we have some feedback.

[jasonkarns]

Some additional bits that I would recommend in the docs:

The npm documentation uses node 20 as an example, but that node does not ship with a compatible version of the npm CLI. (cli v11.5.1+ is required for the feature to work)

So whatever examples are used, should either show explicitly upgrading npm (if using the stock version of node which is presently v20); or better yet, give examples showing node v24 which includes a compatible version of npm OOTB and doesn't require additional setup.

[mikehardy]

It's worse than whether it is unclear that NODE_AUTH_TOKEN needs to be set or not, it is the case that if you set up OIDC Trusted Publish to npmjs.org and you don't actually clear the NODE_AUTH_TOKEN that actions/setup-node makes up for you when it is unset, your publish will fail. And it will do so with a 404 error which is unhelpful (but understandable, as if you got a 401 from npmjs.org it would be considered a possible leak of existence status about private packages)

Intensely frustrating.

• Don't default NPM_AUTH_TOKEN to support NPM OIDC #1440

[mikehardy]

In the end I had to revert to using a granular token for an NPM publish. Something about the interaction of actions/setup-node, lerna-current (v9.0.3) and npm current (11.6.2 IIRC, was npm i npm@latest in the runner) was simply not working. Current versions of everything worked as recently as November 27 but failed starting then and I couldn't revive it despite an intense attempt.

I'll revisit in 3 months when my 90-day-max-duration token expires I suppose.

[Shurtu-gal]

Our workflow still didn't work though any help would be appreciated. https://github.com/asyncapi/cli/actions/runs/20265856000/workflow

[jasonkarns]

@Shurtu-gal it doesn't look like you're using the setup-node action to publish. you're using some other action: https://github.com/asyncapi/cli/actions/runs/20265856000/workflow#L127

[Shurtu-gal]

Yeah, @jasonkarns we use changesets for publishing. Should it be causing some problems?

[jasonkarns]

I have no idea what changesets does. What version of npm is it using? What publish command is it running? What version of node is it using? None of that is clear.

[Shurtu-gal]

It is a npm package used when we have a monorepo. The action just parses over changlog and publishes new package.

The environment as shown here is:

Environment details
  node: v24.11.1
  npm: 11.6.2
  yarn: 1.22.22

Upon unsetting NODE_AUTH_TOKEN we get EENDAUTH error and when not unset we get 404 Not found error.