NPM publish using OIDC on github actions

[michalsek]

Why are you starting this discussion?

Question

What GitHub Actions topic or product is this about?

Misc

Discussion Details

I have setup an workflow to publish package to npm using OIDC together with deployment environment that restricts it to branches main and release/*.

When it runs from main branch everything works perfectly, but runs from release/sem.ver.x fails on 404 error. f.e.

npm error 404 Not Found - PUT https://registry.npmjs.org/react-native-audio-api - Not found
npm error 404
npm error 404  'react-native-audio-api@0.8.3' is not in this registry.
npm error 404

full log: https://github.com/software-mansion/react-native-audio-api/actions/runs/18281894790/job/52046819082

is there any additional step required to make it work properly from non-main branches, or it is some known limitation for github oidc+npm?

Thanks!

[KarunarathneRR]

It looks like you are running into an issue where your GitHub Actions workflow works fine for the main branch but fails with a 404 error when triggered from a release/* branch. This error typically occurs when the npm registry cannot find the package you're trying to publish.

Possible causes and solutions:

1. Permissions issue:

   • It's possible that the GitHub Actions workflow is not properly authenticating when it is triggered from the release/* branch. This could be related to how the OIDC authentication is set up.
   • Ensure that your OIDC provider (which I assume is GitHub’s own OIDC integration) is configured correctly and that the npm registry has the right permissions for publishing from the release/* branches.

   Make sure the access token used during the workflow has the appropriate permissions for the release/* branches. This could involve updating your npm authentication setup within the GitHub Actions workflow, particularly the npm login step, to ensure it has the necessary rights.

2. Package name conflict:

   • The error you're seeing (Not found: react-native-audio-api@0.8.3) could be caused by a situation where the npm registry is expecting a version that hasn't been properly published or is somehow locked out for that specific branch. Double-check that the version you're attempting to publish (0.8.3) is not already restricted or blocked for non-main branches.
   • Ensure that the version number is correct and hasn’t been already published in a way that makes it inaccessible from certain branches.

3. Branch-specific deployment settings:

   • If you're using deployment environments that restrict actions to certain branches, double-check that the environment variables, secrets, or permissions associated with your release/* branches are the same as those for the main branch.
   • There could be a step in your workflow that uses branch-specific conditions (for example, only publishing from main) that might be misconfigured or need adjustment.

4. OIDC configuration:

   • GitHub’s OIDC support generally allows for secure, token-based authentication, but there might be something in the configuration that is working differently across branches. Review the flow to ensure that OIDC tokens are being issued and handled correctly for the release/* branch.

5. Retry publishing manually:

   • You might want to try to manually run the npm publish command from your release/* branch and see if that also results in the same error. This might help determine if the issue is with GitHub Actions or if there's something else happening with your npm setup.

Next Steps:

• Double-check the workflow YAML configuration for any branch-specific conditions.
• Review the npm registry and check the permissions and any branch restrictions for the package you're trying to publish.
• Ensure that the OIDC token setup is working correctly for all branches.
• Consider logging additional debugging information in your GitHub Actions to get more context about the error, especially around the authentication step.

[joebowbeer]

@michalsek Did you resolve this? If so, how?