From 74a93731033549f76a4dbb69cf3002537260393a Mon Sep 17 00:00:00 2001
From: Alex Montague <alex.montague@shopify.com>
Date: Fri, 12 Dec 2025 12:09:33 -0500
Subject: [PATCH 1/2] test oidc auth by forcing empty credentials

---
 .github/workflows/release.yml        |  2 +
 .github/workflows/test-oidc-auth.yml | 84 ++++++++++++++++++++++++++++
 2 files changed, 86 insertions(+)
 create mode 100644 .github/workflows/test-oidc-auth.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5e0c440a3ed..7f9d63f107a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -105,6 +105,7 @@ jobs:
           title: Version Packages - ${{ github.ref_name }}
           publish: pnpm release latest
         env:
+          NODE_AUTH_TOKEN: ''
           NPM_TOKEN: ''
           NPM_CONFIG_PROVENANCE: true
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -133,5 +134,6 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ''
+          NODE_AUTH_TOKEN: ''
           NPM_CONFIG_PROVENANCE: true
           SHOPIFY_CLI_BUILD_REPO: ${{ github.repository }}
diff --git a/.github/workflows/test-oidc-auth.yml b/.github/workflows/test-oidc-auth.yml
new file mode 100644
index 00000000000..b1d2ad127d3
--- /dev/null
+++ b/.github/workflows/test-oidc-auth.yml
@@ -0,0 +1,84 @@
+name: Test OIDC Authentication
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  PNPM_VERSION: '10.11.1'
+
+jobs:
+  test-oidc-setup:
+    name: Test OIDC Setup
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup deps
+        uses: ./.github/actions/setup-cli-deps
+        with:
+          node-version: 24.12.0
+
+      - name: Check npm version
+        run: npm --version
+
+      - name: Check Node version
+        run: node --version
+
+      - name: Verify .npmrc configuration
+        run: |
+          echo "=== Checking .npmrc files exist ==="
+          if [ -f ~/.npmrc ]; then
+            echo "✅ ~/.npmrc exists"
+            if grep -q "registry.npmjs.org" ~/.npmrc; then
+              echo "✅ Contains npm registry configuration"
+            fi
+          else
+            echo "ℹ️  No .npmrc in home directory"
+          fi
+
+          if [ -f .npmrc ]; then
+            echo "✅ ./.npmrc exists in project"
+          else
+            echo "ℹ️  No .npmrc in project directory"
+          fi
+
+      - name: Verify environment configuration
+        run: |
+          if [ -z "${NODE_AUTH_TOKEN+x}" ]; then
+            echo "❌ NODE_AUTH_TOKEN not set"
+          else
+            echo "✅ NODE_AUTH_TOKEN is configured"
+          fi
+
+          if [ "${NPM_CONFIG_PROVENANCE}" = "true" ]; then
+            echo "✅ NPM_CONFIG_PROVENANCE is enabled"
+          else
+            echo "❌ NPM_CONFIG_PROVENANCE not enabled"
+          fi
+        env:
+          NODE_AUTH_TOKEN: ''
+          NPM_TOKEN: ''
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Test npm publish dry-run
+        run: |
+          cd packages/cli-kit
+          npm publish --dry-run --provenance --access public 2>&1 | grep -E "(Publishing|provenance|notice|Published)" || true
+        env:
+          NODE_AUTH_TOKEN: ''
+          NPM_TOKEN: ''
+          NPM_CONFIG_PROVENANCE: true
+
+      - name: Check OIDC token availability
+        run: |
+          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL+x}" ]; then
+            echo "✅ OIDC token request URL is available"
+          else
+            echo "❌ OIDC token request URL is NOT available"
+          fi

From f0a718eef13718539460131592ee3b4988373c08 Mon Sep 17 00:00:00 2001
From: Alex Montague <alex.montague@shopify.com>
Date: Fri, 12 Dec 2025 12:15:04 -0500
Subject: [PATCH 2/2] Add PR trigger to test workflow

---
 .github/workflows/test-oidc-auth.yml | 84 ----------------------------
 1 file changed, 84 deletions(-)
 delete mode 100644 .github/workflows/test-oidc-auth.yml

diff --git a/.github/workflows/test-oidc-auth.yml b/.github/workflows/test-oidc-auth.yml
deleted file mode 100644
index b1d2ad127d3..00000000000
--- a/.github/workflows/test-oidc-auth.yml
+++ /dev/null
@@ -1,84 +0,0 @@
-name: Test OIDC Authentication
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  id-token: write
-
-env:
-  PNPM_VERSION: '10.11.1'
-
-jobs:
-  test-oidc-setup:
-    name: Test OIDC Setup
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Setup deps
-        uses: ./.github/actions/setup-cli-deps
-        with:
-          node-version: 24.12.0
-
-      - name: Check npm version
-        run: npm --version
-
-      - name: Check Node version
-        run: node --version
-
-      - name: Verify .npmrc configuration
-        run: |
-          echo "=== Checking .npmrc files exist ==="
-          if [ -f ~/.npmrc ]; then
-            echo "✅ ~/.npmrc exists"
-            if grep -q "registry.npmjs.org" ~/.npmrc; then
-              echo "✅ Contains npm registry configuration"
-            fi
-          else
-            echo "ℹ️  No .npmrc in home directory"
-          fi
-
-          if [ -f .npmrc ]; then
-            echo "✅ ./.npmrc exists in project"
-          else
-            echo "ℹ️  No .npmrc in project directory"
-          fi
-
-      - name: Verify environment configuration
-        run: |
-          if [ -z "${NODE_AUTH_TOKEN+x}" ]; then
-            echo "❌ NODE_AUTH_TOKEN not set"
-          else
-            echo "✅ NODE_AUTH_TOKEN is configured"
-          fi
-
-          if [ "${NPM_CONFIG_PROVENANCE}" = "true" ]; then
-            echo "✅ NPM_CONFIG_PROVENANCE is enabled"
-          else
-            echo "❌ NPM_CONFIG_PROVENANCE not enabled"
-          fi
-        env:
-          NODE_AUTH_TOKEN: ''
-          NPM_TOKEN: ''
-          NPM_CONFIG_PROVENANCE: true
-
-      - name: Test npm publish dry-run
-        run: |
-          cd packages/cli-kit
-          npm publish --dry-run --provenance --access public 2>&1 | grep -E "(Publishing|provenance|notice|Published)" || true
-        env:
-          NODE_AUTH_TOKEN: ''
-          NPM_TOKEN: ''
-          NPM_CONFIG_PROVENANCE: true
-
-      - name: Check OIDC token availability
-        run: |
-          if [ -n "${ACTIONS_ID_TOKEN_REQUEST_URL+x}" ]; then
-            echo "✅ OIDC token request URL is available"
-          else
-            echo "❌ OIDC token request URL is NOT available"
-          fi