fix(release): core-wasm publish via pnpm/OIDC — npm 10 + missing NPM_TOKEN dies ENEEDAUTH (LAB-831)

[27Bslash6]

Problem (LAB-831 / LAB-780 follow-up)

The publish-cachekit-core-wasm job added in #85 has never successfully published. Recovery dispatch run 30180731767 (wasm_tag=cachekit-core-wasm-v0.1.1, 2026-07-26) built and packed the wasm artifact fine, then died at publish:

npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/

So @cachekit-io/cachekit@0.1.4 remains uninstallable (its hard dep @cachekit-io/cachekit-core-wasm@0.1.1 is still a 404 on npm) — and merging release PR #83 would ship an equally uninstallable 0.1.5.

Root cause

Two stacked auth bugs in the job:

1. The repo has no NPM_TOKEN secret (repo secrets are only APP_ID/APP_PRIVATE_KEY; auth moved to npm OIDC trusted publishing — that is exactly why publish-cachekit succeeds with its own NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} resolving empty: pnpm 11 falls through to OIDC). The job's Configure npm auth step wrote an empty token into ~/.npmrc, which setup-node's NPM_CONFIG_USERCONFIG shadows anyway — a double no-op.
2. npm publish used Node 22's bundled npm 10, which has no OIDC trusted-publishing support (needs npm ≥ 11.5). No token + no OIDC capability = ENEEDAUTH.

Fix

Drop the dead token steps and publish with the exact invocation the proven publish-cachekit job uses: pnpm publish --access public --provenance --no-git-checks (pnpm 11.8 per packageManager does OIDC).

⚠️ One npmjs.com setting likely still required (can't be done in this PR)

@cachekit-io/cachekit-core-wasm has never existed on npm, and package-level trusted publishers can only be configured on an existing package (npm/cli#8544). Creating a new package via OIDC requires an org-level trusted publisher on the cachekit-io npm org (Settings → Trusted Publishers) pointing at this repo's release-please.yml. If that isn't configured, the alternative is one manual first publish of core-wasm@0.1.1, after which package-level config takes over. (Same consideration applies to #50's broader OIDC migration.)

After merge

Re-run the recovery: gh workflow run release-please.yml -f wasm_tag=cachekit-core-wasm-v0.1.1, verify npm install @cachekit-io/cachekit@0.1.4 succeeds cold, then merge #83 for 0.1.5. Consumer waiting: nem.api LAB-768 (PR 27b-io/nem.api#9).

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ecd94a22-952e-4e94-82dc-2249b6d2da9a

📥 Commits

Reviewing files that changed from the base of the PR and between 4eb564d and 62d44ae.

📒 Files selected for processing (1)

• .github/workflows/release-please.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lab-831-fix-core-wasm-publish-oidc

---

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​