[arbianst]

Log the OIDC exchange on the publish step

Part of EPIC-4426 Sent Voice.

Root cause

The three 0.2.0 release runs failed with a bare ENEEDAUTH. npm logs the result of its OIDC token exchange at verbose level only, so the default log showed nothing about why no token was obtained. With verbose logs the registry's answer was visible at once:

POST 404 /-/npm/v1/oidc/token/exchange/package/@sentdm%2fvoice-client-core
OIDC token exchange error - package not found

which is npm's message when no trusted publisher on the package matches the workflow. After the trusted publishers were corrected, the same branch published all three packages:

POST 201 /-/npm/v1/oidc/token/exchange/package/@sentdm%2fvoice-client-core
npm verbose oidc Successfully retrieved and set token
+ @sentdm/voice-client-core@0.2.0

Changes

• NPM_CONFIG_LOGLEVEL: verbose on the publish step, so every publish run shows the exchange request, its status and the registry's message.

Verification

Run 39982000492 from this branch published @sentdm/voice-client-core, @sentdm/voice-client and @sentdm/voice-client-react 0.2.0 through the trusted publisher, each with _npmUser GitHub Actions and an attestation.

🤖 Generated with Claude Code