[splincode]

Root cause

The v0.1.1 publish run #39223353299 failed with E404 at npm publish, even though verification and Node/npm version checks passed. actions/setup-node with registry-url generates an _authToken=${NODE_AUTH_TOKEN} npmrc entry; when empty this can suppress npm's Trusted Publishing OIDC exchange. See actions/setup-node#1551.

Fix

• Remove registry-url from setup-node in the publish job to avoid generated token auth configuration.
• Explicitly set the npm registry on npm publish, without adding credentials to npmrc.
• Fail early if OIDC job credentials are missing or classic npm token environment variables are present.
• Bump to 0.1.2 for a fresh release tag. Do not move or reuse the already pushed v0.1.1 tag.
• Keep id-token: write scoped to the publish job and the npm-publish protected environment.

Release

After merging and checking CI, create a new v0.1.2 tag from main to reattempt Trusted Publishing. Never republish the old tag.