From 390c25197fc5d383e1d2c54845e014c34de68c0c Mon Sep 17 00:00:00 2001
From: justsisyphus <justsisyphus@users.noreply.github.com>
Date: Fri, 30 Jan 2026 12:57:15 +0900
Subject: [PATCH] fix: manually create .npmrc without token for OIDC

setup-node with registry-url injects NODE_AUTH_TOKEN secret which is revoked.
Create .npmrc manually with empty _authToken to force OIDC authentication.
---
 .github/workflows/publish-platform.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-platform.yml b/.github/workflows/publish-platform.yml
index ca7666c6..0631e53d 100644
--- a/.github/workflows/publish-platform.yml
+++ b/.github/workflows/publish-platform.yml
@@ -192,7 +192,12 @@ jobs:
         if: steps.check.outputs.skip != 'true'
         with:
           node-version: "24"
-          registry-url: "https://registry.npmjs.org"
+
+      - name: Configure npm for OIDC publishing
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          echo "registry=https://registry.npmjs.org/" > ~/.npmrc
+          echo "//registry.npmjs.org/:_authToken=" >> ~/.npmrc
 
       - name: Publish ${{ matrix.platform }}
         if: steps.check.outputs.skip != 'true'