[skeet70]

actions/setup-node@v7 no longer exports a placeholder NODE_AUTH_TOKEN when the caller doesn't provide one. With registry-url set, it still writes an .npmrc whose _authToken references ${NODE_AUTH_TOKEN}, and yarn v1 aborts on the unresolved variable before installing anything:

error Error: Failed to replace env in config: ${NODE_AUTH_TOKEN}

This broke the ironnode 1.3.0 publish (https://github.com/IronCoreLabs/ironnode/actions/runs/38970496957/job/117207389973) and will break the next release of recrypt-wasm-binding and recrypt-node-binding, the other callers.

This removes registry-url. Trusted Publishing doesn't read .npmrc: npm 11's OIDC exchange uses the configured registry, which defaults to https://registry.npmjs.org/.

Checked locally with yarn 1.22.22 against ironnode's package.json and yarn.lock: yarn install --frozen-lockfile fails with the CI stack trace when NPM_CONFIG_USERCONFIG points at an .npmrc containing ${NODE_AUTH_TOKEN} and the variable is unset, and succeeds with no .npmrc. With no .npmrc, npm config get registry returns https://registry.npmjs.org/. The OIDC publish itself is exercised only by the next release run.

Non-breaking: tag-version stays v1, so typescript-release-v1.0.0 moves on merge.

[github-actions]

Merging this PR will move these workflow tags:

typescript-release-v1.0.0

[github-actions]

File	Coverage	Lines
All files	66%	66%	✅

Minimum allowed coverage is 24%

Generated by 🐒 cobertura-action against 6d15d7c