ci(sdk): drop registry-url so npm actually uses OIDC to publish

[nandal]

Problem

The first real publish (run 30397586602) passed every gate, built the correct tarball, and then failed at the publish step:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@bytesbrains%2fmaktub-sdk

Nothing was published — the registry still holds three versions and 0.1.0-dev.4 is untouched and reusable.

The trusted-publisher config was not at fault. registry-url makes setup-node write an .npmrc containing //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} and export NODE_AUTH_TOKEN as the literal placeholder XXXXX-XXXXX-XXXXX-XXXXX when no token is supplied. npm saw a configured credential, used it instead of attempting the OIDC exchange, and the registry rejected the garbage token.

npm returns E404 rather than E401 so it doesn't leak which private packages exist — which is why a shadowed credential reads like a misconfigured publisher and sends you looking in the wrong place.

Change summary

• Removed registry-url from setup-node, with a comment explaining why it must stay removed so nobody "fixes" it back. npm falls back to its default registry — the same host — and authenticates via OIDC.
• Added an "OIDC must be available and unshadowed" gate that fails early and by name on both silent failure modes: no OIDC token endpoint, or an _authToken configured in any npmrc npm reads. This class of break should never again surface as an opaque E404 after the artifact has been built.

Tests

Diagnosed on a real runner rather than assumed. A throwaway branch printed the runner's actual state, and with registry-url absent:

ACTIONS_ID_TOKEN_REQUEST_URL set? YES
NODE_AUTH_TOKEN value: <unset>
--- npmrc (none) ---
(no user npmrc)

That also settles a red herring worth recording: GitHub does not list Id-token in the "GITHUB_TOKEN Permissions" log group even when it is granted. That group showed only Contents: read / Metadata: read on both runs, which initially looked like the permission had been dropped. It hadn't — the env var proves OIDC was available all along. The new gate checks the env var, not the log group.

YAML re-validated; 13 steps, permissions unchanged (contents: read, id-token: write).

Authentication is still only genuinely exercised on a real publish, so the proof is the next non-dry run.

Risk

Low. Confined to the publish workflow, which is inert until dispatched. The failure mode being fixed leaves nothing behind — the previous attempt wrote nothing to the registry.

Backwards-compat

None affected. No source file, published artifact, or other workflow is touched.

Privacy copy

No user-facing privacy copy.

🤖 Generated with Claude Code

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[wrokin]

🤖 wrokin code review

Summary: Removes registry-url to prevent OIDC shadowing and adds a pre‑publish OIDC health check.

No high‑signal issues (bug/security/correctness) identified in this diff.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}

[wrokin]

🤖 wrokin security audit

No security-relevant findings in this diff. The changes remove an incorrect registry-url that was shadowing OIDC trusted publishing and add a preflight check to catch misconfigurations before publish — both are security improvements, not vulnerabilities.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}

[wrokin]

🛡️ wrokin security hunter

No vulnerabilities were proven in this pull request — the hunter found nothing it could exploit and prove by execution.

Advisory only — this check never blocks your PR.