Follow-up recorded at the ledger-v2 merge closeout (not a release blocker for 0.5.0, which shipped via manual OTP publish).
Tag-triggered OIDC publishing has now failed three times (v0.3.0, v0.4.0, v0.5.0), each with the identical signature:
npm error 404 Not Found - PUT https://registry.npmjs.org/@aestheticfunction%2fdspack-export
with no OIDC token-exchange notice in the log — the exchange never produces credentials. The workflow file (.github/workflows/release.yml: Node 24 / npm ≥ 11.5, id-token: write, registry-url set) is mechanically identical to dspack-spec's, whose trusted publishing works, so the failure is on the npm side: the Trusted Publisher registration for this package (package settings → Trusted publisher → repository aestheticfunction/dspack-export, workflow release.yml) needs to be checked/re-created by the package owner before the next version tag is pushed.
🤖 Generated with Claude Code
Follow-up recorded at the ledger-v2 merge closeout (not a release blocker for 0.5.0, which shipped via manual OTP publish).
Tag-triggered OIDC publishing has now failed three times (v0.3.0, v0.4.0, v0.5.0), each with the identical signature:
with no OIDC token-exchange notice in the log — the exchange never produces credentials. The workflow file (
.github/workflows/release.yml: Node 24 / npm ≥ 11.5,id-token: write,registry-urlset) is mechanically identical to dspack-spec's, whose trusted publishing works, so the failure is on the npm side: the Trusted Publisher registration for this package (package settings → Trusted publisher → repositoryaestheticfunction/dspack-export, workflowrelease.yml) needs to be checked/re-created by the package owner before the next version tag is pushed.🤖 Generated with Claude Code