From 784cc79d658fd8bf3d6a9e943aef4685376e0f21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=9C=D0=B0=D0=BA=D1=81=D0=B8=D0=BC=20=D0=98=D0=B2=D0=B0?=
 =?UTF-8?q?=D0=BD=D0=BE=D0=B2?= <omaxphp@yandex.ru>
Date: Mon, 19 Oct 2026 11:34:08 +0300
Subject: [PATCH 1/3] fix(ci): let npm use OIDC instead of empty setup-node
 auth token

---
 .github/workflows/publish.yml | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4f35f10..2f93e3a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -84,7 +84,6 @@ jobs:
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
-          registry-url: https://registry.npmjs.org
           package-manager-cache: false
 
       - name: Require OIDC-compatible npm
@@ -103,7 +102,21 @@ jobs:
             }
           '
 
+      # OIDC requires no authentication token in npm config. Supplying
+      # registry-url to setup-node writes a classic _authToken placeholder,
+      # which can prevent npm from starting its OIDC exchange.
+      - name: Verify OIDC credentials are available
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}"
+          test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}"
+          if [[ -n "${NODE_AUTH_TOKEN:-}" || -n "${NPM_TOKEN:-}" ]]; then
+            echo "Unexpected npm token environment variable; OIDC must be used" >&2
+            exit 1
+          fi
+
       # No npm install or dependency scripts in the OIDC-enabled job.
       # npm automatically generates provenance for public packages.
       - name: Publish to npm via OIDC
-        run: npm publish --access public --ignore-scripts
+        run: npm publish --access public --ignore-scripts --registry=https://registry.npmjs.org/

From 80f77fe391e41cdb6f2b745b361576790d02edda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=9C=D0=B0=D0=BA=D1=81=D0=B8=D0=BC=20=D0=98=D0=B2=D0=B0?=
 =?UTF-8?q?=D0=BD=D0=BE=D0=B2?= <omaxphp@yandex.ru>
Date: Mon, 19 Oct 2026 11:34:10 +0300
Subject: [PATCH 2/3] chore: prepare v0.1.2 for OIDC validation

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 63b83d6..26976bc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "prettier-plugin-angular-comment",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Format Angular templates in JS/TS template literals with /* Angular */",
   "type": "module",
   "exports": {

From 99e67d8d638aac9256ad138097c9b85b225f5cca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=9C=D0=B0=D0=BA=D1=81=D0=B8=D0=BC=20=D0=98=D0=B2=D0=B0?=
 =?UTF-8?q?=D0=BD=D0=BE=D0=B2?= <omaxphp@yandex.ru>
Date: Mon, 19 Oct 2026 11:34:13 +0300
Subject: [PATCH 3/3] docs: use v0.1.2 in OIDC release example

---
 README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index c8959cf..9b97429 100644
--- a/README.md
+++ b/README.md
@@ -82,13 +82,13 @@ Keep the version in `package.json` synchronized with the first published version
 
 ### Publish the next version
 
-Update `package.json` to an unpublished version (for example, `0.1.1`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:
+Update `package.json` to an unpublished version (for example, `0.1.2`), merge it to `main`, and confirm CI is green. Then push the corresponding tag **from a commit on main**:
 
 ```sh
 git switch main
 git pull --ff-only
-git tag v0.1.1
-git push origin v0.1.1
+git tag v0.1.2
+git push origin v0.1.2
 ```
 
 The [publish workflow](./.github/workflows/publish.yml) verifies the exact version and that the tag commit is on `main`, runs tests without OIDC permissions, and publishes in a separate approval-gated environment. The publisher job disables npm lifecycle scripts and uses npm's short-lived OIDC authentication and automatic provenance. Pinned GitHub Action commit SHAs and disabled release-job caching reduce supply-chain risk.