fix(ci): drop registry-url so OIDC trusted publishing engages

[charfeng1]

Root cause

setup-node@v4 with registry-url writes ~/.npmrc containing:

//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}

We deliberately have no NODE_AUTH_TOKEN secret (OIDC trusted publishing replaces tokens). npm reads "empty bearer token" from .npmrc, sends it to npmjs.org → 404 Not Found before ever trying OIDC.

Verification (via debug step on the same branch)

##[notice]OIDC token URL is set — id-token: write IS granted
##[notice]OIDC request token IS set

So id-token: write was always being granted correctly; the GITHUB_TOKEN permissions log just doesn't display it. The blocker was npm preferring the empty _authToken over OIDC.

Fix

One line: drop registry-url from the publish job's setup-node. npm defaults to registry.npmjs.org anyway, and with no .npmrc auth config it finds and uses the OIDC token automatically.

After merge

The push will trigger another publish run. Expected outcome: v1.0.8 lands on npm with the green "Built and signed on GitHub Actions" provenance badge, plus a v1.0.8 git tag and GitHub release. If something else is wrong, the error message should now be specific to OIDC/trust (not a generic 404).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced GitHub Actions release workflow configuration to improve the security and reliability of package publishing processes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: edd5b8a0-0ba5-4e4a-a56e-bcf850b8d42c

📥 Commits

Reviewing files that changed from the base of the PR and between efaf189 and d5892cc.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

📝 Walkthrough

Walkthrough

This PR modifies the release workflow to remove explicit npm registry URL configuration from Node.js setup, enabling GitHub OIDC trusted publishing for npm authentication instead of environment variable-based token management.

Changes

CI/CD npm authentication setup

Layer / File(s)	Summary
Node.js setup for GitHub OIDC trusted publishing .github/workflows/release.yml	The actions/setup-node@v4 step in the publish job no longer sets registry-url: https://registry.npmjs.org, allowing GitHub OIDC tokens to handle npm registry authentication without requiring an .npmrc file with environment variable tokens.

Possibly related PRs

• charfeng1/opencode-ralph-loop#7: Both PRs modify the publish job's actions/setup-node@v4 configuration for Node 24, addressing npm authentication setup and registry URL handling.

Poem

🐰 No tokens in .npmrc today,
OIDC trust shows the modern way,
Registry setup simplified and clean,
GitHub's credentials now intervene!

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing registry-url configuration to enable OIDC trusted publishing in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-oidc-no-registry-url

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}