fix(ci): strip stale _authToken so OIDC Trusted Publisher actually fires on Release

[chrischall]

Summary

Strip _authToken from the .npmrc that setup-node generates, so npm publish --provenance has no stale placeholder static-token to try before falling through to OIDC. Trusted Publisher is correctly configured on the npm side — this just removes the foot-gun in the workflow.

Why

Every release run since Trusted Publisher was set up has failed with:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@fetchproxy%2fprotocol - Not found
npm error 404  '@fetchproxy/protocol@0.4.1' is not in this registry.

Diagnostic readout from the failed run:

release  Publish @fetchproxy/protocol to npm  env:
                                              NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX

XXXXX-XXXXX-XXXXX-XXXXX is GitHub Actions' masked rendering of an empty masked value. We don't pass NPM_TOKEN (the whole point is OIDC), so NODE_AUTH_TOKEN is empty — but setup-node already wrote //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN} into .npmrc, which npm picks up as "the user has a static token to use." It tries that placeholder before OIDC, the registry rejects, and the privacy-preserving 404 hides the actual failure mode.

Notable: the provenance / sigstore step worked (Provenance statement published to transparency log: ...) — which means OIDC IS reachable. npm just never tries it for the actual PUT, because the static token is "available."

Fix

Add a second sed to the cleanup step that already strips always-auth:

sed -i '/_authToken/d' "$NPM_CONFIG_USERCONFIG"

Then dump the final .npmrc to the log so future debugging has a record of what npm actually sees.

Test plan

• After merge, re-trigger Tag & Bump (bumps to 0.4.3) and watch Release succeed without 404
• No real-token-based release path is broken — we don't have an NPM_TOKEN secret defined for this repo

🤖 Generated with Claude Code