I noticed publish.yml sets:
env:
NODE_AUTH_TOKEN: ""
NPM_TOKEN: ""
on the Publish to NPM (Trusted Publisher) step, and both look unused now that publishing goes through OIDC trusted publishing (id-token: write + npm publish --provenance). Looks like dead leftover config from before the OIDC migration — I'd remove the env: block from that step.
Split out from #19.
I noticed
publish.ymlsets:on the
Publish to NPM (Trusted Publisher)step, and both look unused now that publishing goes through OIDC trusted publishing (id-token: write+npm publish --provenance). Looks like dead leftover config from before the OIDC migration — I'd remove theenv:block from that step.Split out from #19.