fix(ci): configure changesets to skip npm auth for OIDC

[GarthDB]

Problem

PR #671 enabled OIDC trusted publishing and all 8 packages have been configured on npmjs.com, but the publish still failed with:

npm ERR! code ENEEDAUTH
npm ERR! need auth This command requires you to be logged in

Root Cause

The changesets/action@v1 was creating an .npmrc file expecting the (now removed) NPM_TOKEN environment variable. This prevented npm CLI from auto-detecting the OIDC environment and using trusted publishers.

From the logs:

No user .npmrc file found, creating one

Solution

Added skipNpmAuth: true to the changesets action configuration. This prevents the action from creating token-based authentication, allowing npm CLI (11.5.1+) to automatically detect and use OIDC authentication.

How OIDC Works

With id-token: write permission and trusted publishers configured:

1. npm CLI automatically detects GitHub Actions OIDC environment
2. Exchanges the OIDC ID token for an npm registry token
3. Uses that token for authentication (all automatic)

No NPM_TOKEN secret needed!

Verification

All 8 packages have trusted publishers configured:

• ✅ @adobe/changeset-linter
• ✅ @adobe/optimized-diff
• ✅ @adobe/spectrum-component-api-schemas
• ✅ @adobe/spectrum-component-diff-generator
• ✅ @adobe/spectrum-design-data-mcp
• ✅ @adobe/spectrum-diff-core
• ✅ @adobe/spectrum-tokens
• ✅ @adobe/token-diff-generator

Testing

This can be verified by:

1. Merging this PR
2. Re-running the failed release workflow
3. Confirming packages publish successfully with OIDC auth

Related

• Fixes failed publish from feat(ci): migrate to npm trusted publishing with OIDC #671
• Enables successful publishing for the queued packages from Version Packages #670

[changeset-bot]

⚠️ No Changeset found

Latest commit: a7231dc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[GarthDB]

Run report for a7231dcd

Total time: 7ms | Comparison time: 0s | Estimated loss: 7ms (100.0% slower)

	Action	Time	Status	Info
🟩	SyncWorkspace	6.9ms	Passed

Touched files

.github/workflows/release.yml