[htnabe]

Summary

• The publish workflow reached the actual bun publish step but failed with error: missing authentication (run \bunx npm login`), even though id-token: writewas granted and the npm package has a Trusted Publisher configured for this repository/workflow. Root cause: npm's OIDC Trusted Publisher flow performs a token exchange that is implemented by the **npm CLI** (>= 11.5.1), not bybun publish`. Bun does not yet support this OIDC exchange, so it has no credentials to authenticate with.

Changes

• .github/workflows/publish.yml: added a Setup Node.js step (actions/setup-node@v4, registry-url: https://registry.npmjs.org) to the publish job, and switched the final publish command from bun publish --access public --tag "$npm_tag" to npm publish --access public --tag "$npm_tag". The rest of the job (install, lint, test, build, pack dry-run) continues to use Bun.
• docs/development/publishing.md: documented that npm publish (not bun publish) performs the OIDC exchange.
• CHANGELOG.md: documented the fix under the 0.0.1-rc.2 entry.

Validation

• bun run format:check — passes
• bun run lint — passes
• Verified locally that npm --version (12.0.2, bundled with Node 24) supports Trusted Publisher OIDC exchange (requires >= 11.5.1).

Risks

• Low risk: this only changes which CLI performs the final npm publish step in an environment-gated, workflow_dispatch-only job. No functional/runtime code changes. If the npm Trusted Publisher configuration on npmjs.com is itself misconfigured, this change alone will not fix publishing — it fixes the tool-side integration gap only.

Checklist

• Conventional commit(s) with gitemoji used
• Commit granularity is meaningful
• Tests and lint were run as appropriate
• Documentation updated if needed

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!