From aef8fcc03855fa79261d75dd80d21948f1e93892 Mon Sep 17 00:00:00 2001
From: leeguooooo <guoli@zhihu.com>
Date: Tue, 24 Feb 2026 17:24:20 +0900
Subject: [PATCH] =?UTF-8?q?ci(release):=20=E4=BF=AE=E5=A4=8D=20OIDC=20?=
 =?UTF-8?q?=E5=8F=91=E5=B8=83=E8=AE=A4=E8=AF=81=E9=93=BE=E8=B7=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

移除 setup-node 的 registry-url 注入，避免发布步骤继承无效 NODE_AUTH_TOKEN。

发布前升级 npm 到 v11，使用独立 npmrc 并启用 provenance，以匹配 npm trusted publishing。
---
 .github/workflows/release.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 028c6e1..0f24843 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -160,7 +160,6 @@ jobs:
         with:
           node-version: '22'
           cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
 
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
@@ -239,7 +238,15 @@ jobs:
       - name: Publish to npm (trusted publishing)
         id: publish_npm
         if: steps.changesets.outputs.hasChangesets == 'false' && steps.publish_check.outputs.needs_publish == 'true'
-        run: pnpm ci:publish
+        env:
+          NODE_AUTH_TOKEN: ""
+          NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/trusted-npmrc
+          NPM_CONFIG_PROVENANCE: "true"
+        run: |
+          npm install -g npm@^11
+          npm --version
+          printf "registry=https://registry.npmjs.org/\n" > "$NPM_CONFIG_USERCONFIG"
+          pnpm ci:publish
 
       - name: Set release outputs
         id: publish_metadata