From 9570748f9505547304b9c3fae1de2ff14cb1729c Mon Sep 17 00:00:00 2001
From: Am0rfu5 <1178902+Am0rfu5@users.noreply.github.com>
Date: Sun, 5 Jul 2026 11:44:25 +0000
Subject: [PATCH] fix(release): clear placeholder NODE_AUTH_TOKEN + http-log
 the publish

ENEEDAUTH persists with a clean env: registry silently rejects the

OIDC exchange. Log HTTP to surface the exchange response; explicitly

empty NODE_AUTH_TOKEN (setup-node can inject a default placeholder).
---
 .github/workflows/release.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 46e43f5..d905971 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,8 +47,10 @@ jobs:
       # OIDC Trusted Publishing (configured on npmjs.com for DiamondsLab/diamonds):
       # no NPM_TOKEN — auth comes from the OIDC id-token; provenance is generated.
       - name: Publish (npm OIDC Trusted Publishing)
+        env:
+          NODE_AUTH_TOKEN: '' # setup-node can inject a placeholder default; any set token disables the OIDC exchange
         run: |
           echo "npm: $(npm --version)"
           echo "OIDC id-token URL present: ${ACTIONS_ID_TOKEN_REQUEST_URL:+YES}"
           echo "registry: $(npm config get registry)"
-          npm publish --provenance --access public
+          npm publish --provenance --access public --loglevel http