Skip to content

chore(release): drop setup-node registry-url, not needed for trusted publishing - #514

Merged
christoph-sg merged 1 commit into
mainfrom
ch/fix-release-setup-node
Oct 21, 2026
Merged

christoph-sg merged 1 commit into
mainfrom
ch/fix-release-setup-node

Conversation

@christoph-sg

Copy link
Copy Markdown
Contributor

The release workflow has failed in actions/setup-node on every run since #511:

error Error: Failed to replace env in config: ${NODE_AUTH_TOKEN}

With registry-url set, setup-node writes an .npmrc containing _authToken=${NODE_AUTH_TOKEN} and then runs yarn cache dir for caching. Yarn 1 throws when that variable is undefined. Before #511 it was defined, as an empty string, via secrets.NPM_TOKEN.

Trusted publishing doesn't need the .npmrc: npm's OIDC flow only uses GitHub's ACTIONS_ID_TOKEN_REQUEST_* env vars and the default registry (registry.npmjs.org), so this drops registry-url.

Test plan

Reproduced locally with yarn 1.22.22: yarn cache dir fails with the same error when the setup-node style .npmrc is present and NODE_AUTH_TOKEN is unset, and succeeds without that .npmrc. The main-branch release run after merging confirms setup-node passes; the npm publish itself is exercised by the v0.5.1 tag.

@christoph-sg
christoph-sg requested a review from fkling October 21, 2026 08:57
@christoph-sg
christoph-sg merged commit 73d52cb into main Oct 21, 2026
5 checks passed
@christoph-sg
christoph-sg deleted the ch/fix-release-setup-node branch October 21, 2026 09:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants