Is there an existing issue for this?

• I have searched the existing issues and found similar reports: [BUG] OIDC publish failing from GitHub actions #8730, [BUG] Publishing another version with OIDC fails to find an earlier published version of a scoped package #8678

This issue exists in the latest npm version

• I am using the latest npm (upgraded via npm install -g npm@latest in workflow)

Current Behavior

Publishing 12 scoped packages (@sbtools/core, @sbtools/sdk, @sbtools/plugin-*) via npm trusted publishing (OIDC) from GitHub Actions fails with E404 on all packages:

npm error 404 Not Found - PUT https://registry.npmjs.org/@sbtools%2fcore - Not found
npm error 404 '@sbtools/core@0.2.0' is not in this registry.
npm notice Access token expired or revoked. Please try logging in again.

The workflow uses OIDC (no NPM_TOKEN):

No NPM_TOKEN found, but OIDC is available - using npm trusted publishing

Provenance is signed successfully before the PUT fails:

npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log

Expected Behavior

npm publish should succeed using trusted publishing (OIDC) without NPM_TOKEN.

Steps To Reproduce

• Repo: https://github.com/bazokhan/supabase-tools
• Workflow: https://github.com/bazokhan/supabase-tools/blob/main/.github/workflows/release.yml
• Trigger: push to main (when changesets determines packages to publish)

Workflow config:

• Node 22
• npm install -g npm@latest (to satisfy npm 11.5.1+ requirement)
• id-token: write permission
• changesets/action runs npx changeset publish --no-git-tag
• Trusted publishers configured on npm for all 12 packages: repo=bazokhan/supabase-tools, workflow=release.yml

Environment

• npm: latest (via npm install -g npm@latest)
• Node.js: 22.22.0 (GitHub hosted runner)
• OS: Ubuntu (GitHub actions runner)
• Monorepo with 12 packages in packages/*

Verified

• @sbtools npm org exists
• All 12 packages have trusted publisher configured on npmjs.com (repo: bazokhan/supabase-tools, workflow: release.yml)
• Workflow runs directly on push to main (no workflow_call)
• id-token: write is set