fix(#1440): Support NPM OIDC tokens by not exporting default NODE_AUTH_TOKEN

[Satishchoudhary94]

Problem

The action was exporting a fake NODE_AUTH_TOKEN value (XXXXX-XXXXX-XXXXX-XXXXX) by default,
which broke NPM OIDC authentication. OIDC requires NODE_AUTH_TOKEN to be either unset or empty.

Solution

Only export NODE_AUTH_TOKEN if it was explicitly provided by the user.

Changes

• Modified configAuthentication() in authutil.ts to check if NODE_AUTH_TOKEN exists before exporting
• Added tests to verify OIDC behavior

Testing

• All authutil tests pass (15/15)
• OIDC authentication now works properly
• Backward compatible with users who explicitly provide tokens

[jrjohnson]

Lost an entire day debugging trusted publishing today when it was this secret token the entire time. The world will be a better place if this PR gets merged!

[Satishchoudhary94]

@jrjohnson Thanks for confirming this helps! Appreciate the feedback 🙌

[gowridurgad]

Hi @Satishchoudhary94, thank you for your contribution!

@jrjohnson, @TheJefe, as discussed in the comments on issue #1440, we were able to successfully publish to npm using OIDC with the existing setup-node code. Could you please check and confirm if you are also able to do so on your end?

@Satishchoudhary94 , could you kindly let us know whether these changes are still needed and share any specific use cases that required these file modifications?

We truly appreciate your effort and look forward to hearing from you. Thanks!

[gowridurgad]

Hi everyone, Gentle reminder on this. Looking forward to your update when you have a moment.
Thanks!

[Satishchoudhary94]

Hi @gowridurgad, thanks a lot for taking the time to check this.

I went through this again carefully from my side.

From what i’ve observed, this issue seems to depend on the environment. In cases where a default NODE_AUTH_TOKEN gets set (even as a placeholder), npm does not fall back to OIDC and instead tries token-based auth, which leads to failure.

At the same time, I completely understand why it may be working fine in your setup if the variable isn’t being injected or is already unset, the issue won’t show up.

So this change is mainly to make the behavior safer and more predictable:

-->Avoid exporting a placeholder token by default
-->Ensure OIDC flows are not unintentionally affected

This also aligns with feedback from users who had to manually unset NODE_AUTH_TOKEN to make OIDC work.

If it helps, I’m happy to share a minimal repro workflow where this difference is visible. Totally open to suggestions or improvements here as well.

Thanks again for the review!.