[BUG] OIDC publish failing from GitHub actions

[nex3]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

My publishing workflow for a nested package is failing with the following error:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@sass%2ftypes - Not found
npm error 404
npm error 404  The requested resource '@sass/types@1.94.0' could not be found or you do not have permission to access it.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.

You can see the wokflow here. It's invoked from ci.yml here.

I've verified that it's not the following gotchas:

• The workflow is upgrading to the latest npm (line 119).

• The workflow has the id-token: write permissions (line 40 of ci.yml).

• The trusted publisher settings are pointing to the correct repo and the filename of the parent workflow:

  

Expected Behavior

I would expect npm publish to succeed and publish the package using OIDC.

Steps To Reproduce

Rerunning the GitHub Actions workflow reproduces this consistently

Environment

• npm: Whatever npm@latest was at time of posting
• Node.js: 24.11.0
• OS Name: Ubuntu Linux
• System Model Name: GitHub actions runner
• npm config: GitHub actions default

[dirkwa]

I have the same. Following.

[agillispie]

same issue here had to revert to tokens

[macalbert]

Same here https://github.com/macalbert/envilder/actions/runs/19404399928/job/55517129647

[Jason3S]

@nex3,

There are a few things that I added to the workflow, to get it to work. I'm not sure which one is important in your case:

• package.json added: "provenance": true

  "publishConfig": {
    "access": "public",
    "provenance": true
  },

• To the workflow: env: NPM_CONFIG_PROVENANCE: true

      - run: npm publish
        env:
          NPM_CONFIG_PROVENANCE: true

Here is a link to a successful run: https://github.com/streetsidesoftware/jest-mock-vscode/actions/runs/19406225809/job/55521264235

In this case I used Node 24.x and NPM version 11.6.2. Node 22.x did not work for me.

I'm not sure if this will help.

[nex3]

Thanks for the tip, @Jason3S. Passing --provenance to npm publish and setting "repo" to the repository that I was publishing from allowed me to deploy successfully.

Perhaps this should be added to the documentation?