Trusted Publisher OIDC fails with "package not found" for packages in monorepo subdirectories (nested workspace packages)

[CarlosEduJs]

🏷️ Discussion Type

Bug

Body

Summary
npm publish with OIDC Trusted Publishing fails with error ENEEDAUTH / E404.

The failure occurs for a package located in a subdirectory of a monorepo (packages/ikihsjs). The Trusted Publisher configuration is correct and verified.

Environment

• npm: 11.16.0
• Node.js: 24.18.0
• Runner: GitHub Actions (ubuntu-latest)
• Package manager for install/build: pnpm
• Publish command: plain npm publish
• Repository layout: monorepo with package at packages/ikihsjs

package.json (relevant fields)

"repository": {
  "type": "git",
  "url": "git+https://github.com/carlosedujs/ikihs.git",
  "directory": "packages/ikihsjs"
}

Trusted Publisher Configuration (npmjs.com)

• Repository: carlosedujs/ikihs
• Workflow: publish.yml
• Allowed actions: npm publish ✅

Workflow Permissions

permissions:
  contents: write
  id-token: write

Verification Steps Performed

1. Trusted Publisher config
   I deliberately added a typo (capital letter) in the repository configuration as a test. This produced a different, config-mismatch error. After I corrected the typo, the original “package not found” error returned. This confirms that the OIDC validation passes and the failure happens after this step.

2. npm version
   I ran npm install -g npm@latest before publish. The error remained.

3. Registry and authentication
   The registry URL is set correctly via actions/setup-node. NODE_AUTH_TOKEN is intentionally unset (no legacy token).

4. Workspace command
   I tried npm publish --workspace packages/ikihsjs from the repository root. The same failure occurred.

Verbose Log (relevant lines)

npm http fetch GET https://.../idtoken/... 200  
npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/ikihsjs  
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found  
npm error code ENEEDAUTH  
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/

Important Note
The GitHub Actions ID Token request succeeds (status 200). The Provenance Statement is signed and published successfully to the Sigstore transparency log. The failure occurs only on the npm token exchange endpoint (/-/npm/v1/oidc/token/exchange/package/{name}), which returns 404 “package not found”.

Suspected Root Cause
The issue is likely related to how npm resolves the package during the OIDC token exchange when the package uses repository.directory (subdirectory in a monorepo). This matches the pattern reported in npm/cli#8730 and npm/cli#8678.

Related Issues

• [BUG] OIDC publish failing from GitHub actions npm/cli#8730
• [BUG] Publishing another version with OIDC fails to find an earlier published version of a scoped package npm/cli#8678
• OIDC trusted publishing E404 when publishing scoped packages from changesets/action npm/cli#8976

I can provide the full debug log or a minimal reproduction repository if needed.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐