Merge pull request #8582 from Shopify/gonzalo/snapit-oidc-diagnostics

Diagnose npm OIDC failures without publishing

Author: gonzaloriestra

.github/workflows/release.yml

@@ -26,6 +26,10 @@ on:
           - nightly
           - latest
           - experimental
+      diagnostics_only:
+        description: 'Inspect npm OIDC authentication without publishing'
+        default: false
+        type: boolean
 
 concurrency:
   group: changeset-${{ github.head_ref || github.run_id }}
@@ -39,7 +43,7 @@ jobs:
   # Snapit job - runs when /snapit comment is made on a PR
   snapit:
     name: Snapit
-    if: ${{ github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.body == '/snapit' }}
+    if: ${{ github.event_name == 'issue_comment' && github.event.issue.pull_request && (github.event.comment.body == '/snapit' || github.event.comment.body == '/snapit-oidc') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -56,9 +60,42 @@ jobs:
         uses: ./.github/actions/setup-cli-deps
         with:
           node-version: 24.12.0
+      - &npm-oidc-diagnostics
+        name: Inspect npm OIDC authentication
+        continue-on-error: true
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const idToken = await core.getIDToken('npm:registry.npmjs.org');
+            const [encodedHeader, encodedClaims] = idToken.split('.');
+            const header = JSON.parse(Buffer.from(encodedHeader, 'base64url').toString());
+            const claims = JSON.parse(Buffer.from(encodedClaims, 'base64url').toString());
+            // Log only identity metadata, never the signed token or exchanged credential.
+            const claimNames = [
+              'iss', 'aud', 'sub', 'repository', 'workflow_ref', 'job_workflow_ref',
+              'environment', 'runner_environment', 'event_name',
+            ];
+            const identity = Object.fromEntries(claimNames.map((name) => [name, claims[name] ?? null]));
+            core.info(JSON.stringify({alg: header.alg, kid: header.kid, claims: identity}, null, 2));
+
+            // Test the registry directly to separate identity rejection from publishing tooling.
+            const response = await fetch('https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@shopify%2fcli', {
+              method: 'POST',
+              headers: {Authorization: `Bearer ${idToken}`},
+              signal: AbortSignal.timeout(10000),
+            });
+            core.info(`npm OIDC token exchange: HTTP ${response.status}`);
+            for (const name of ['date', 'cf-ray', 'x-npm-request-id', 'x-github-request-id']) {
+              const value = response.headers.get(name);
+              if (value) core.info(`${name}: ${value}`);
+            }
+            // The response can contain an npm credential; never read or log its body.
+            await response.body?.cancel();
       - name: Force snapshot changeset
+        if: ${{ github.event.comment.body == '/snapit' }}
         run: "mv .changeset/force-snapshot-build.md.ignore .changeset/force-snapshot-build.md"
       - name: Create snapshot version
+        if: ${{ github.event.comment.body == '/snapit' }}
         uses: Shopify/snapit@2a7ca29133cfeb2c8703654d54bc6dbc565caa69 # registry-and-package-manager
         with:
           comment_is_global: 'true'
@@ -202,7 +239,9 @@ jobs:
         uses: ./.github/actions/setup-cli-deps
         with:
           node-version: 24.12.0
+      - *npm-oidc-diagnostics
       - name: Release
+        if: ${{ !inputs.diagnostics_only }}
         run: pnpm release ${{ github.event.inputs.tag || 'nightly' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}