From 144765beac8d97ab507420ae30cc33295c905273 Mon Sep 17 00:00:00 2001 From: Lenoux01 <60329596+Lenoux01@users.noreply.github.com> Date: Tue, 8 Sep 2026 16:18:12 +0200 Subject: [PATCH] docs(release): name the Allowed-actions trap in the trusted-publisher notes The header lists the four fields a trusted publisher needs, and a release run configured exactly that way still failed with `403 OIDC permission denied for this action` after the provenance was signed. The fifth field, "Allowed actions", defaults to `npm stage publish` only for configurations created after 2026-09-03, and this workflow runs `npm publish`. Older configurations (before 2026-05-20) got `npm publish` automatically, which is why the same file publishes one package and not another. The comment now names the field, the default, and the symptom. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dacff28..19e5d60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,15 @@ name: release # Repository nextup # Workflow filename release.yml # Environment (blank) +# Allowed actions npm publish (ticked) +# +# "Allowed actions" is the trap. A configuration created after 2026-09-03 +# defaults to `npm stage publish` only, and this workflow runs `npm publish`. +# The symptom is a run that signs the provenance and then dies with +# `403 OIDC permission denied for this action`: the token exchange succeeded, +# the action was refused. Configurations created before 2026-05-20 got +# `npm publish` automatically, which is why an older package's copy of this +# file publishes while a new package's does not (nextup v0.1.2/v0.1.3, 2026-09-08). # # Renaming this file, or moving the job to another workflow, breaks publishing # until that field is updated to match.