From 9f6c566d4c21438b4ce03c881a99b41ae87c8929 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:03:32 +0000
Subject: [PATCH 1/5] feat: add GitHub Actions npm trusted publishing workflow

- Add enablePublishingOnGitHubActions() to configure-publish.mts so the
  new GHA workflow can gate publish steps via GITHUB_OUTPUT
- Update apply-additional-tags.mjs to fall back to NODE_AUTH_TOKEN env
  var when --token is not provided; avoids token-in-process-args on GHA
- Add .github/workflows/microsoft-npm-publish.yml: OIDC trusted publishing
  on *-stable branch pushes, with npm-publish environment protection
---
 .ado/scripts/apply-additional-tags.mjs      | 41 +++++++---
 .ado/scripts/configure-publish.mts          | 11 +++
 .github/workflows/microsoft-npm-publish.yml | 86 +++++++++++++++++++++
 3 files changed, 127 insertions(+), 11 deletions(-)
 create mode 100644 .github/workflows/microsoft-npm-publish.yml

diff --git a/.ado/scripts/apply-additional-tags.mjs b/.ado/scripts/apply-additional-tags.mjs
index 73bb0f35829f..4b65a08df2eb 100644
--- a/.ado/scripts/apply-additional-tags.mjs
+++ b/.ado/scripts/apply-additional-tags.mjs
@@ -8,6 +8,10 @@ import * as util from "node:util";
  * Usage: node apply-additional-tags.mjs --tags <tags> --token <token>
  *        node apply-additional-tags.mjs --tags <tags> --dry-run
  * Where tags is a comma-separated list of tags (e.g., "next,v0.79-stable")
+ *
+ * When running in GitHub Actions with actions/setup-node configured, the auth
+ * token can be provided via the NODE_AUTH_TOKEN environment variable instead
+ * of the --token flag.
  */
 
 const registry = "https://registry.npmjs.org/";
@@ -28,14 +32,19 @@ const packages = [
  * @param {Options} options
  * @returns {number}
  */
-function main({ tags, token, "dry-run": dryRun }) {
+function main({ tags, token: tokenArg, "dry-run": dryRun }) {
   if (!tags) {
     console.log("No additional tags to apply");
     return 0;
   }
 
+  // Prefer explicit --token arg (ADO), fall back to NODE_AUTH_TOKEN env var (GHA OIDC).
+  const token = tokenArg ?? process.env.NODE_AUTH_TOKEN;
+
   if (!dryRun && !token) {
-    console.error("Error: npm auth token is required (use --dry-run to preview)");
+    console.error(
+      "Error: npm auth token is required (use --token, set NODE_AUTH_TOKEN, or use --dry-run to preview)"
+    );
     return 1;
   }
 
@@ -58,17 +67,27 @@ function main({ tags, token, "dry-run": dryRun }) {
   for (const tag of tags.split(",")) {
     for (const pkg of packages) {
       console.log(`Adding dist-tag '${tag}' to ${pkg}@${version}`);
+
+      // When --token is explicitly provided (ADO path), pass auth inline so
+      // that npm picks it up without a pre-configured .npmrc.
+      // When NODE_AUTH_TOKEN is used instead (GHA OIDC path), actions/setup-node
+      // has already written .npmrc with `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`,
+      // so no inline auth argument is needed.
+      const npmArgs = [
+        "dist-tag",
+        "add",
+        `${pkg}@${version}`,
+        tag,
+        "--registry",
+        registry,
+      ];
+      if (tokenArg) {
+        npmArgs.push(`--//registry.npmjs.org/:_authToken=${tokenArg}`);
+      }
+
       const result = spawnSync(
         "npm",
-        [
-          "dist-tag",
-          "add",
-          `${pkg}@${version}`,
-          tag,
-          "--registry",
-          registry,
-          `--//registry.npmjs.org/:_authToken=${token}`,
-        ],
+        npmArgs,
         { stdio: "inherit", shell: true }
       );
 
diff --git a/.ado/scripts/configure-publish.mts b/.ado/scripts/configure-publish.mts
index 0d080975bbcb..dc90a64ad3a2 100644
--- a/.ado/scripts/configure-publish.mts
+++ b/.ado/scripts/configure-publish.mts
@@ -34,6 +34,16 @@ function enablePublishingOnAzurePipelines() {
   echo(`##vso[task.setvariable variable=publish_react_native_macos]1`);
 }
 
+/**
+ * Writes `publish_react_native_macos=1` to `GITHUB_OUTPUT` to signal that we
+ * want to enable publishing on GitHub Actions.
+ */
+function enablePublishingOnGitHubActions() {
+  if (process.env['GITHUB_OUTPUT']) {
+    fs.appendFileSync(process.env['GITHUB_OUTPUT'], `publish_react_native_macos=1\n`);
+  }
+}
+
 export function isMainBranch(branch: string): boolean {
   return branch === 'main';
 }
@@ -204,6 +214,7 @@ async function enablePublishing(tagInfo: TagInfo, options: Options) {
   // Don't enable publishing in PRs
   if (!getTargetBranch()) {
     enablePublishingOnAzurePipelines();
+    enablePublishingOnGitHubActions();
   }
 }
 
diff --git a/.github/workflows/microsoft-npm-publish.yml b/.github/workflows/microsoft-npm-publish.yml
new file mode 100644
index 000000000000..7ef24f316462
--- /dev/null
+++ b/.github/workflows/microsoft-npm-publish.yml
@@ -0,0 +1,86 @@
+name: Publish to npm
+
+# Mirrors the trigger used by the Azure Pipelines publish.yml:
+# runs on every push to a stable release branch.
+on:
+  push:
+    branches:
+      - "*-stable"
+
+jobs:
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+
+    # Only run in the upstream repo, not in forks.
+    if: github.repository == 'microsoft/react-native-macos'
+
+    # The `npm-publish` GitHub environment should be configured with any
+    # required reviewers / protection rules.  It also must match the
+    # environment name registered as a Trusted Publisher on npmjs.com for
+    # each of the published packages.
+    environment: npm-publish
+
+    permissions:
+      contents: read
+      # Required for npm Trusted Publishing (OIDC): lets the job request a
+      # short-lived publish token from npmjs.com without storing credentials.
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          filter: blob:none
+          fetch-depth: 0
+
+      - name: Setup toolchain
+        uses: ./.github/actions/microsoft-setup-toolchain
+        with:
+          node-version: "22"
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      # Determine whether this branch/version should be published and, if so,
+      # which dist-tag(s) to use.  Outputs:
+      #   publish_react_native_macos – '1' when publishing should proceed
+      #   publishTag                 – the primary npm dist-tag (e.g. 'latest')
+      #   additionalTags             – comma-separated extra tags (may be empty)
+      - name: Verify release config
+        id: configure-publish
+        run: node .ado/scripts/configure-publish.mts --verbose --skip-auth
+
+      # Configure yarn to target the public npm registry.
+      # Auth is handled by OIDC Trusted Publishing – do NOT set npmAuthToken here.
+      - name: Configure yarn for npm publishing
+        if: steps.configure-publish.outputs.publish_react_native_macos == '1'
+        run: |
+          yarn config set npmPublishAccess public
+          yarn config set npmPublishRegistry "https://registry.npmjs.org"
+
+      # Publish all non-private workspace packages.
+      # --provenance enables npm Trusted Publishing: yarn requests an OIDC token
+      # from GitHub Actions and exchanges it with npmjs.com – no stored secret needed.
+      - name: Publish packages
+        if: steps.configure-publish.outputs.publish_react_native_macos == '1'
+        run: |
+          yarn workspaces foreach -vv --all --topological --no-private npm publish \
+            --provenance \
+            --tag "${{ steps.configure-publish.outputs.publishTag }}" \
+            --tolerate-republish
+
+      # Apply any additional dist-tags (e.g. promoting a branch tag to 'next').
+      # npm dist-tag add does not support OIDC, so a granular NPM_TOKEN secret
+      # is required for this step.  NODE_AUTH_TOKEN is the conventional env var
+      # that actions/setup-node (called inside microsoft-setup-toolchain) wires
+      # into the project-level .npmrc it creates.
+      - name: Apply additional dist-tags
+        if: >-
+          steps.configure-publish.outputs.publish_react_native_macos == '1' &&
+          steps.configure-publish.outputs.additionalTags != ''
+        run: |
+          node .ado/scripts/apply-additional-tags.mjs \
+            --tags "${{ steps.configure-publish.outputs.additionalTags }}"
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From d0b912f48f0b5a1206d26d633496bd15e2d92eeb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 16:56:59 +0000
Subject: [PATCH 2/5] chore: address PR review feedback on npm publish workflow

- Remove verbose/obvious comments from workflow and scripts
- Drop --token CLI arg from apply-additional-tags.mjs; use NODE_AUTH_TOKEN
  env var only; update ADO job accordingly
- Remove JSDoc from self-explanatory enablePublishingOnGitHubActions()
- Add isGitHubActions boolean to configure-publish.mts and use it to
  select between ADO and GHA signaling (instead of calling both)
---
 .ado/jobs/npm-publish.yml                   |  4 +++-
 .ado/scripts/apply-additional-tags.mjs      | 25 ++++----------------
 .ado/scripts/configure-publish.mts          | 13 ++++++-----
 .github/workflows/microsoft-npm-publish.yml | 26 ++++-----------------
 4 files changed, 20 insertions(+), 48 deletions(-)

diff --git a/.ado/jobs/npm-publish.yml b/.ado/jobs/npm-publish.yml
index 7da6c6029a76..12f5ba7e9c01 100644
--- a/.ado/jobs/npm-publish.yml
+++ b/.ado/jobs/npm-publish.yml
@@ -52,9 +52,11 @@ jobs:
         condition: and(succeeded(), eq(variables['publish_react_native_macos'], '1'))
 
       - script: |
-          node .ado/scripts/apply-additional-tags.mjs --tags "$(additionalTags)" --token "$(npmAuthToken)"
+          node .ado/scripts/apply-additional-tags.mjs --tags "$(additionalTags)"
         displayName: Apply additional dist-tags
         condition: and(succeeded(), eq(variables['publish_react_native_macos'], '1'))
+        env:
+          NODE_AUTH_TOKEN: $(npmAuthToken)
 
     - script: |
         yarn config unset npmPublishAccess || true
diff --git a/.ado/scripts/apply-additional-tags.mjs b/.ado/scripts/apply-additional-tags.mjs
index 4b65a08df2eb..42d207adb62b 100644
--- a/.ado/scripts/apply-additional-tags.mjs
+++ b/.ado/scripts/apply-additional-tags.mjs
@@ -5,13 +5,11 @@ import * as util from "node:util";
 
 /**
  * Apply additional dist-tags to published packages
- * Usage: node apply-additional-tags.mjs --tags <tags> --token <token>
+ * Usage: node apply-additional-tags.mjs --tags <tags>
  *        node apply-additional-tags.mjs --tags <tags> --dry-run
  * Where tags is a comma-separated list of tags (e.g., "next,v0.79-stable")
  *
- * When running in GitHub Actions with actions/setup-node configured, the auth
- * token can be provided via the NODE_AUTH_TOKEN environment variable instead
- * of the --token flag.
+ * Auth token is read from the NODE_AUTH_TOKEN environment variable.
  */
 
 const registry = "https://registry.npmjs.org/";
@@ -23,7 +21,6 @@ const packages = [
 /**
  * @typedef {{
  *   tags?: string;
- *   token?: string;
  *   "dry-run"?: boolean;
  * }} Options;
  */
@@ -32,18 +29,17 @@ const packages = [
  * @param {Options} options
  * @returns {number}
  */
-function main({ tags, token: tokenArg, "dry-run": dryRun }) {
+function main({ tags, "dry-run": dryRun }) {
   if (!tags) {
     console.log("No additional tags to apply");
     return 0;
   }
 
-  // Prefer explicit --token arg (ADO), fall back to NODE_AUTH_TOKEN env var (GHA OIDC).
-  const token = tokenArg ?? process.env.NODE_AUTH_TOKEN;
+  const token = process.env.NODE_AUTH_TOKEN;
 
   if (!dryRun && !token) {
     console.error(
-      "Error: npm auth token is required (use --token, set NODE_AUTH_TOKEN, or use --dry-run to preview)"
+      "Error: NODE_AUTH_TOKEN is required (use --dry-run to preview)"
     );
     return 1;
   }
@@ -68,11 +64,6 @@ function main({ tags, token: tokenArg, "dry-run": dryRun }) {
     for (const pkg of packages) {
       console.log(`Adding dist-tag '${tag}' to ${pkg}@${version}`);
 
-      // When --token is explicitly provided (ADO path), pass auth inline so
-      // that npm picks it up without a pre-configured .npmrc.
-      // When NODE_AUTH_TOKEN is used instead (GHA OIDC path), actions/setup-node
-      // has already written .npmrc with `//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}`,
-      // so no inline auth argument is needed.
       const npmArgs = [
         "dist-tag",
         "add",
@@ -81,9 +72,6 @@ function main({ tags, token: tokenArg, "dry-run": dryRun }) {
         "--registry",
         registry,
       ];
-      if (tokenArg) {
-        npmArgs.push(`--//registry.npmjs.org/:_authToken=${tokenArg}`);
-      }
 
       const result = spawnSync(
         "npm",
@@ -107,9 +95,6 @@ const { values } = util.parseArgs({
     tags: {
       type: "string",
     },
-    token: {
-      type: "string",
-    },
     "dry-run": {
       type: "boolean",
       default: false,
diff --git a/.ado/scripts/configure-publish.mts b/.ado/scripts/configure-publish.mts
index dc90a64ad3a2..b8e40e5540b2 100644
--- a/.ado/scripts/configure-publish.mts
+++ b/.ado/scripts/configure-publish.mts
@@ -2,6 +2,8 @@
 import { $, argv, echo, fs } from 'zx';
 import { resolve } from 'node:path';
 
+const isGitHubActions = process.env['GITHUB_ACTIONS'] === 'true';
+
 const NPM_DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 const NPM_TAG_NEXT = 'next';
 
@@ -34,10 +36,6 @@ function enablePublishingOnAzurePipelines() {
   echo(`##vso[task.setvariable variable=publish_react_native_macos]1`);
 }
 
-/**
- * Writes `publish_react_native_macos=1` to `GITHUB_OUTPUT` to signal that we
- * want to enable publishing on GitHub Actions.
- */
 function enablePublishingOnGitHubActions() {
   if (process.env['GITHUB_OUTPUT']) {
     fs.appendFileSync(process.env['GITHUB_OUTPUT'], `publish_react_native_macos=1\n`);
@@ -213,8 +211,11 @@ async function enablePublishing(tagInfo: TagInfo, options: Options) {
 
   // Don't enable publishing in PRs
   if (!getTargetBranch()) {
-    enablePublishingOnAzurePipelines();
-    enablePublishingOnGitHubActions();
+    if (isGitHubActions) {
+      enablePublishingOnGitHubActions();
+    } else {
+      enablePublishingOnAzurePipelines();
+    }
   }
 }
 
diff --git a/.github/workflows/microsoft-npm-publish.yml b/.github/workflows/microsoft-npm-publish.yml
index 7ef24f316462..5e98a6d8be9d 100644
--- a/.github/workflows/microsoft-npm-publish.yml
+++ b/.github/workflows/microsoft-npm-publish.yml
@@ -1,7 +1,5 @@
 name: Publish to npm
 
-# Mirrors the trigger used by the Azure Pipelines publish.yml:
-# runs on every push to a stable release branch.
 on:
   push:
     branches:
@@ -12,19 +10,13 @@ jobs:
     name: Publish to npm
     runs-on: ubuntu-latest
 
-    # Only run in the upstream repo, not in forks.
     if: github.repository == 'microsoft/react-native-macos'
 
-    # The `npm-publish` GitHub environment should be configured with any
-    # required reviewers / protection rules.  It also must match the
-    # environment name registered as a Trusted Publisher on npmjs.com for
-    # each of the published packages.
+    # Matches the environment name registered as a Trusted Publisher on npmjs.com.
     environment: npm-publish
 
     permissions:
       contents: read
-      # Required for npm Trusted Publishing (OIDC): lets the job request a
-      # short-lived publish token from npmjs.com without storing credentials.
       id-token: write
 
     steps:
@@ -45,23 +37,18 @@ jobs:
       # Determine whether this branch/version should be published and, if so,
       # which dist-tag(s) to use.  Outputs:
       #   publish_react_native_macos – '1' when publishing should proceed
-      #   publishTag                 – the primary npm dist-tag (e.g. 'latest')
-      #   additionalTags             – comma-separated extra tags (may be empty)
+      #   publishTag                 – primary npm dist-tag (e.g. 'latest')
+      #   additionalTags             – extra tags to apply (e.g. 'next', may be empty)
       - name: Verify release config
         id: configure-publish
         run: node .ado/scripts/configure-publish.mts --verbose --skip-auth
 
-      # Configure yarn to target the public npm registry.
-      # Auth is handled by OIDC Trusted Publishing – do NOT set npmAuthToken here.
       - name: Configure yarn for npm publishing
         if: steps.configure-publish.outputs.publish_react_native_macos == '1'
         run: |
           yarn config set npmPublishAccess public
           yarn config set npmPublishRegistry "https://registry.npmjs.org"
 
-      # Publish all non-private workspace packages.
-      # --provenance enables npm Trusted Publishing: yarn requests an OIDC token
-      # from GitHub Actions and exchanges it with npmjs.com – no stored secret needed.
       - name: Publish packages
         if: steps.configure-publish.outputs.publish_react_native_macos == '1'
         run: |
@@ -70,11 +57,8 @@ jobs:
             --tag "${{ steps.configure-publish.outputs.publishTag }}" \
             --tolerate-republish
 
-      # Apply any additional dist-tags (e.g. promoting a branch tag to 'next').
-      # npm dist-tag add does not support OIDC, so a granular NPM_TOKEN secret
-      # is required for this step.  NODE_AUTH_TOKEN is the conventional env var
-      # that actions/setup-node (called inside microsoft-setup-toolchain) wires
-      # into the project-level .npmrc it creates.
+      # npm dist-tag add doesn't support OIDC, so NODE_AUTH_TOKEN (a granular
+      # NPM_TOKEN secret) is still required for this step.
       - name: Apply additional dist-tags
         if: >-
           steps.configure-publish.outputs.publish_react_native_macos == '1' &&

From a2d61ed4d3b3646fe5927b80761fe98b656d7cb2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:07:41 +0000
Subject: [PATCH 3/5] chore: remove apply-additional-tags step from GHA npm
 publish workflow

---
 .github/workflows/microsoft-npm-publish.yml | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/microsoft-npm-publish.yml b/.github/workflows/microsoft-npm-publish.yml
index 5e98a6d8be9d..db67b16c7cc2 100644
--- a/.github/workflows/microsoft-npm-publish.yml
+++ b/.github/workflows/microsoft-npm-publish.yml
@@ -35,10 +35,9 @@ jobs:
         run: yarn install --immutable
 
       # Determine whether this branch/version should be published and, if so,
-      # which dist-tag(s) to use.  Outputs:
+      # which dist-tag to use.  Outputs:
       #   publish_react_native_macos – '1' when publishing should proceed
-      #   publishTag                 – primary npm dist-tag (e.g. 'latest')
-      #   additionalTags             – extra tags to apply (e.g. 'next', may be empty)
+      #   publishTag                 – npm dist-tag (e.g. 'latest')
       - name: Verify release config
         id: configure-publish
         run: node .ado/scripts/configure-publish.mts --verbose --skip-auth
@@ -56,15 +55,3 @@ jobs:
             --provenance \
             --tag "${{ steps.configure-publish.outputs.publishTag }}" \
             --tolerate-republish
-
-      # npm dist-tag add doesn't support OIDC, so NODE_AUTH_TOKEN (a granular
-      # NPM_TOKEN secret) is still required for this step.
-      - name: Apply additional dist-tags
-        if: >-
-          steps.configure-publish.outputs.publish_react_native_macos == '1' &&
-          steps.configure-publish.outputs.additionalTags != ''
-        run: |
-          node .ado/scripts/apply-additional-tags.mjs \
-            --tags "${{ steps.configure-publish.outputs.additionalTags }}"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 9cd204e4f4bff5b4ecf7655d52e96818e71e4b68 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:53:08 +0000
Subject: [PATCH 4/5] chore: trim verbose comment in npm publish workflow

---
 .github/workflows/microsoft-npm-publish.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/microsoft-npm-publish.yml b/.github/workflows/microsoft-npm-publish.yml
index db67b16c7cc2..bc069d8c5b57 100644
--- a/.github/workflows/microsoft-npm-publish.yml
+++ b/.github/workflows/microsoft-npm-publish.yml
@@ -34,10 +34,6 @@ jobs:
       - name: Install dependencies
         run: yarn install --immutable
 
-      # Determine whether this branch/version should be published and, if so,
-      # which dist-tag to use.  Outputs:
-      #   publish_react_native_macos – '1' when publishing should proceed
-      #   publishTag                 – npm dist-tag (e.g. 'latest')
       - name: Verify release config
         id: configure-publish
         run: node .ado/scripts/configure-publish.mts --verbose --skip-auth

From 76a13b60601e358b083ac0b72d343ce858b27542 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 31 Jul 2026 20:35:34 +0000
Subject: [PATCH 5/5] chore: address review feedback on npm publish scripts and
 workflow

---
 .ado/jobs/npm-publish.yml                   |  2 +-
 .ado/scripts/apply-additional-tags.mjs      | 11 +------
 .ado/scripts/configure-publish.mts          | 34 ++-------------------
 .github/workflows/microsoft-npm-publish.yml |  8 ++++-
 4 files changed, 12 insertions(+), 43 deletions(-)

diff --git a/.ado/jobs/npm-publish.yml b/.ado/jobs/npm-publish.yml
index 12f5ba7e9c01..0fa3d7196c68 100644
--- a/.ado/jobs/npm-publish.yml
+++ b/.ado/jobs/npm-publish.yml
@@ -34,7 +34,7 @@ jobs:
       displayName: Install npm dependencies
 
     - script: |
-        node .ado/scripts/configure-publish.mts --verbose --skip-auth
+        node .ado/scripts/configure-publish.mts --verbose
       displayName: Verify release config
 
     # Disable Nightly publishing on the main branch
diff --git a/.ado/scripts/apply-additional-tags.mjs b/.ado/scripts/apply-additional-tags.mjs
index 42d207adb62b..eebeda1bafb5 100644
--- a/.ado/scripts/apply-additional-tags.mjs
+++ b/.ado/scripts/apply-additional-tags.mjs
@@ -64,18 +64,9 @@ function main({ tags, "dry-run": dryRun }) {
     for (const pkg of packages) {
       console.log(`Adding dist-tag '${tag}' to ${pkg}@${version}`);
 
-      const npmArgs = [
-        "dist-tag",
-        "add",
-        `${pkg}@${version}`,
-        tag,
-        "--registry",
-        registry,
-      ];
-
       const result = spawnSync(
         "npm",
-        npmArgs,
+        ["dist-tag", "add", `${pkg}@${version}`, tag, "--registry", registry],
         { stdio: "inherit", shell: true }
       );
 
diff --git a/.ado/scripts/configure-publish.mts b/.ado/scripts/configure-publish.mts
index b8e40e5540b2..31b336441f56 100644
--- a/.ado/scripts/configure-publish.mts
+++ b/.ado/scripts/configure-publish.mts
@@ -4,7 +4,6 @@ import { resolve } from 'node:path';
 
 const isGitHubActions = process.env['GITHUB_ACTIONS'] === 'true';
 
-const NPM_DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
 const NPM_TAG_NEXT = 'next';
 
 export type ReleaseState = 'STABLE_IS_LATEST' | 'STABLE_IS_NEW' | 'STABLE_IS_OLD';
@@ -23,15 +22,10 @@ export interface TagInfo {
 
 interface Options {
   'mock-branch'?: string;
-  'skip-auth'?: boolean;
   tag?: string;
   verbose?: boolean;
 }
 
-/**
- * Exports a variable, `publish_react_native_macos`, to signal that we want to
- * enable publishing on Azure Pipelines.
- */
 function enablePublishingOnAzurePipelines() {
   echo(`##vso[task.setvariable variable=publish_react_native_macos]1`);
 }
@@ -168,23 +162,6 @@ export function getPublishTags(
   }
 }
 
-async function verifyNpmAuth(registry = NPM_DEFAULT_REGISTRY) {
-  const whoami = await $`npm whoami --registry ${registry}`.nothrow();
-  if (whoami.exitCode !== 0) {
-    const errText = whoami.stderr;
-    const m = errText.match(/npm error code (\w+)/);
-    const errorCode = m && m[1];
-    switch (errorCode) {
-      case 'EINVALIDNPMTOKEN':
-        throw new Error(`Invalid auth token for npm registry: ${registry}`);
-      case 'ENEEDAUTH':
-        throw new Error(`Missing auth token for npm registry: ${registry}`);
-      default:
-        throw new Error(errText);
-    }
-  }
-}
-
 async function enablePublishing(tagInfo: TagInfo, options: Options) {
   const [primaryTag, ...additionalTags] = tagInfo.npmTags;
 
@@ -203,18 +180,14 @@ async function enablePublishing(tagInfo: TagInfo, options: Options) {
     }
   }
 
-  if (options['skip-auth']) {
-    echo('ℹ️ Skipped npm auth validation');
-  } else {
-    await verifyNpmAuth();
-  }
-
   // Don't enable publishing in PRs
   if (!getTargetBranch()) {
     if (isGitHubActions) {
       enablePublishingOnGitHubActions();
-    } else {
+    } else if (process.env['TF_BUILD'] === 'True') {
       enablePublishingOnAzurePipelines();
+    } else {
+      echo('ℹ️ Local run — publishing not enabled');
     }
   }
 }
@@ -227,7 +200,6 @@ if (isDirectRun) {
   // Parse CLI args using zx's argv (minimist)
   const options: Options = {
     'mock-branch': argv['mock-branch'] as string | undefined,
-    'skip-auth': Boolean(argv['skip-auth']),
     tag: typeof argv['tag'] === 'string' ? argv['tag'] : NPM_TAG_NEXT,
     verbose: Boolean(argv['verbose']),
   };
diff --git a/.github/workflows/microsoft-npm-publish.yml b/.github/workflows/microsoft-npm-publish.yml
index bc069d8c5b57..3f196f0a8516 100644
--- a/.github/workflows/microsoft-npm-publish.yml
+++ b/.github/workflows/microsoft-npm-publish.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Verify release config
         id: configure-publish
-        run: node .ado/scripts/configure-publish.mts --verbose --skip-auth
+        run: node .ado/scripts/configure-publish.mts --verbose
 
       - name: Configure yarn for npm publishing
         if: steps.configure-publish.outputs.publish_react_native_macos == '1'
@@ -51,3 +51,9 @@ jobs:
             --provenance \
             --tag "${{ steps.configure-publish.outputs.publishTag }}" \
             --tolerate-republish
+
+      - name: Remove npm auth configuration
+        if: always()
+        run: |
+          yarn config unset npmPublishAccess || true
+          yarn config unset npmPublishRegistry || true