ci: add temporary npm/OIDC publish diagnostics (#234)

geist@1.7.2 fails to publish with ENEEDAUTH despite OIDC trusted publishing
working two weeks ago with an unchanged workflow. Print node/npm/pnpm versions
(and which binary), the registry, and whether the OIDC token endpoint is
exposed to the job, to confirm or rule out npm not using the OIDC-capable
binary at publish time. Temporary; remove once the publish is fixed.

Author: christopherkindl

.github/workflows/ci.yaml

@@ -196,6 +196,20 @@ jobs:
           rm -rf packages/next/dist/fonts
           mv artifacts/packages/next/dist/fonts packages/next/dist/fonts
 
+      # TEMP diagnostic: ENEEDAUTH on OIDC publish (geist@1.7.2). Confirms whether
+      # the npm that `changeset publish` will use is the OIDC-capable one (>= 11.5.1)
+      # and whether the OIDC token endpoint is actually exposed to this job.
+      # Remove once the publish is fixed.
+      - name: Diagnose npm/OIDC publish environment
+        working-directory: packages/next
+        run: |
+          echo "node: $(node --version) ($(command -v node))"
+          echo "npm:  $(npm --version) ($(command -v npm))"
+          echo "pnpm: $(pnpm --version) ($(command -v pnpm))"
+          echo "registry: $(npm config get registry)"
+          echo "OIDC token URL present:   ${ACTIONS_ID_TOKEN_REQUEST_URL:+yes}"
+          echo "OIDC request token present: ${ACTIONS_ID_TOKEN_REQUEST_TOKEN:+yes}"
+
       - name: Create Release Pull Request or Publish
         id: changesets
         uses: changesets/action@v1.8.0