[🔥AUDIT🔥] Fixes for publishing with OIDC

[jeremywiebe]

🖍 This is an audit! 🖍

Summary:

Publishing failed again with the following error:

🦋  info npm info @khanacademy/graphql-flow
🦋  info @khanacademy/graphql-flow is being published because our local version (3.4.2) has not been published on npm
🦋  info Publishing "@khanacademy/graphql-flow" at "3.4.2"
🦋  error an error occurred while publishing @khanacademy/graphql-flow: ENEEDAUTH This command requires you to be logged in to https://registry.npmjs.org
🦋  error You need to authorize this machine using `npm adduser`
🦋  error npm error code ENEEDAUTH
🦋  error npm error need auth This command requires you to be logged in to https://registry.npmjs.org
🦋  error npm error need auth You need to authorize this machine using `npm adduser`
🦋  error npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-29T21_54_32_205Z-debug-0.log
🦋  error
🦋  error packages failed to publish:
🦋  @khanacademy/[email protected]
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

After doing some Googling and talking to the genie, I found two open source PRs dealing with OIDC and publishing that look to have fixes we need:

• Need publishConfig in package.json (RobEasthope/protomolecule#304)
• Need npm v11.5.1+ (RobEasthope/protomolecule#306)

Issue: "none"

Test plan:

Cut a release and watch 🍿

[changeset-bot]

⚠️ No Changeset found

Latest commit: 18b7eee

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[jaredly]

👍️