v0.3.6 GitHub release published, but npm package is missing

[alsd4git]

The v0.3.6 GitHub release is available, including the npm package tarball:

https://github.com/0xSero/litter/releases/tag/v0.3.6

However, version 0.3.6 is not available from npm:

npm install kittylitter@0.3.6
# E404 No match found for version 0.3.6

The release workflow appears to have failed specifically in the publish-npm job:

https://github.com/0xSero/litter/actions/runs/31504783052

The GitHub release and build artifacts were created, but the npm registry still reports 0.3.4 as the latest version.

Could you please investigate and retry/fix the npm publication for v0.3.6?

[0xSero]

Re-ran the release workflow for v0.3.6 against current main (run 34775579055) — the publish-npm job publishes from the same tag with the current workflow. Watching it; will confirm once 0.3.6 shows up on npm or the job fails again with a fresh log.

[0xSero]

Root cause found. The publish-npm job uses npm trusted publishing (GitHub OIDC): release.yml grants id-token: write, actions/setup-node writes the registry config, and — with no NPM_TOKEN secret in this repo — setup-node exports its documented placeholder auth token and npm switches to the OIDC path. That wiring is intact and unchanged.

Evidence:

• v0.3.4 published successfully from this workflow on 2026-05-22 (run 26310089340, publish-npm: success) with the same trusted-publishing setup.
• v0.3.5 (run 30978813092) and v0.3.6 (run 31504783052) both failed identically: E404 Not Found - PUT https://registry.npmjs.org/kittylitter, i.e. the registry refused the publish.
• Nothing repo-side explains the flip: the only publish-npm changes after v0.3.4 are a checkout step, a checksum-verification script, and --provenance; the published package metadata (repository: dnakov/litter) is unchanged since 0.3.4.
• Re-running from current main (34775579055) is not a usable retry: it dispatches from main, fails at "Create GitHub Release" (the tag already exists), and never reaches publish-npm.

What remains is npm-registry side, and fixing it needs npmjs.com access to the package (the kittylitter package is owned by the dnakov npm account):

1. Trusted publisher entry — package settings → Trusted Publisher must exactly match GitHub user/org 0xSero, repository litter, workflow filename release.yml, environment empty (all case-sensitive). If that entry was removed or re-pointed after May, publishes fail exactly like this.
2. package.json repository.url — npm's trusted-publishing requirements say the package's repository.url must exactly match the publishing repository. It currently says git+https://github.com/dnakov/litter.git (cargo-dist generates it from the git remote). That value was already in place when 0.3.4 published successfully, but if npm now enforces the match, this metadata needs updating too.

Once fixed, the correct retry is job-scoped so the published 0.3.6 stays byte-identical to the GitHub release artifacts:

gh run rerun 31504783052 --job 93828239196

That re-executes the original run's publish job against the original release commit rather than current main. Binaries on the GitHub release are unaffected — only the npm channel is broken (0.3.5 and 0.3.6 never reached npm; latest is still 0.3.4).

[0xSero]

Addendum: today's v0.3.7 release (from main, run via the auto-release flow) hit the same publish-npm failure, so npm is now missing 0.3.5, 0.3.6, and 0.3.7 — latest remains 0.3.4. The diagnosis and npmjs.com fix above covers all three; the job-scoped rerun command should then be run for each original release run.

[0xSero]

Current state: v0.3.6+ npm publishes fail with E404-PUT because the npm publish path can't authenticate. Root cause chain (from the publish logs): the package metadata points at the historical dnakov/litter repository, and npm trusted publishing (GitHub OIDC) only works when the publishing repo matches the package's configured repository — the publishing repo here is 0xSero/litter.

Unblocking requires one of, and it needs an npm account holder to do it (not automatable from CI):

1. Sign in on npm as the package owner (the dnakov-side account) and either update the package's repository field to https://github.com/0xSero/litter + configure trusted publishing for this repo, or
2. Add an NPM_TOKEN (automation token) secret to this repo so the publish job uses token auth instead of OIDC.

CI-side publish tooling itself is healthy (the publish-npm job runs and fails only at the E404-PUT auth step). This issue stays open until an npm account holder performs that step — it is not automatable from this repo alone.