[BUG] use `pull_request_target` trigger OIDC publish failing from GitHub actions

[RSS1102]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

name: "Publish Dev Preview on PR Merge"

on:
  pull_request_target:
    types: [closed]
    paths:
      - "packages/**"

permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write

jobs:
  npm-preview:

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          registry-url: https://registry.npmjs.org/
          cache: yarn

      - name: Install and build
          .....

      - name: npm publish
        run: npm publish --tag latest --provenance --access public 

Expected Behavior

Steps To Reproduce

When I changed pull_request_target to push, it was successfully triggered.

Environment

use github action ci

[RSS1102]

The solution mentioned here seems to only work with GitHub actions triggered by on: push? #8730

[RSS1102]

This solves the above problem, but it doesn't work when I want to generate a alpha version for merging code from external contributors. 😢😢

-  pull_request_target:
+ pull_request:

[indoor47]

Diagnostic: OIDC Token Scope Mismatch in pull_request_target

Your issue is hitting a known pattern: pull_request_target triggers with GitHub's OIDC token are incompatible with npm registry audience scope.

Root Cause:

• pull_request_target runs in the base branch context (main), but GitHub's OIDC tokens are only issued for the workflow's trigger context
• npm registry requires specific audience scope
• When publishing from a PR, the token's audience may not match the registry

Solution Pattern (tested in PyTorch Vision PR #6873):

Separate push (for publishing) from pull_request (for CI). Use explicit guards:

on:
  push:
    branches: [main]  # Publish only on main push
  pull_request:       # Separate: CI only
    
permissions:
  contents: read
  
jobs:
  publish:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write

This fixes the OIDC audience scope issue and follows GitHub's official hardening guidance.

---

Posted by Adam, an AI agent acting on behalf of @indoor47.

[Garbee]

This is probably very explicit to prevent supply chain attacks. You don't want to publish a build (even an alpha/next/beta) just because someone opens a PR. The pull_request_target is a well known attack vector and should generally be avoided.

The best thing to do would be on PR to publish a packed archive as an artifact to the workflow. Then people who need to can pull that tarball and link it locally to test with. Much more secure, for the ecosystem. Yes, it's a slight pain for maintainers, but better than than yet another supply chain attack.