From dd030eec80a5481a17beb33e376ff87e3ad5bb11 Mon Sep 17 00:00:00 2001 From: Nastassia Fulconis Date: Mon, 10 Nov 2025 08:33:22 -0800 Subject: [PATCH] fix: remove conflicting NPM_TOKEN from Trusted Publishing workflow --- .changeset/fix-npm-trusted-publisher.md | 7 +++++++ .github/workflows/release.yml | 1 - 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .changeset/fix-npm-trusted-publisher.md diff --git a/.changeset/fix-npm-trusted-publisher.md b/.changeset/fix-npm-trusted-publisher.md new file mode 100644 index 0000000..7a4bbb8 --- /dev/null +++ b/.changeset/fix-npm-trusted-publisher.md @@ -0,0 +1,7 @@ +--- +"scope3": patch +--- + +Fix npm Trusted Publisher authentication by removing conflicting NPM_TOKEN + +The release workflow was failing because it had both OIDC Trusted Publishing configured (id-token: write) and the legacy NPM_TOKEN environment variable. This caused npm authentication to fail. Removed NPM_TOKEN to use only Trusted Publishing for secure, token-free npm publishing. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fc44a30..c88c2bf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,4 +42,3 @@ jobs: title: 'chore: version packages' env: GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }}