Release workflow has been failing for ~6 months — npm publish returns E404 Not Found

The Release workflow (.github/workflows/release.yml) has been failing on every "Version Packages" merge since 2025-12-31 (#4886). The last successful publish run was 2025-12-04 (#4855) — roughly 6 months ago.

Failing Version Packages runs:

Error

All failing runs share the same root cause in the changesets/action publish step:

  error an error occurred while publishing nextra-theme-blog: E404 Not Found - PUT https://registry.npmjs.org/nextra-theme-blog - Not found
  error '[email protected]' is not in this registry.
  error an error occurred while publishing nextra-theme-docs: E404 Not Found - PUT https://registry.npmjs.org/nextra-theme-docs - Not found
  error an error occurred while publishing nextra: E404 Not Found - PUT https://registry.npmjs.org/nextra - Not found
  error packages failed to publish:
 ELIFECYCLE  Command failed with exit code 1.

An npm publish returning E404 Not Found - PUT on packages that do exist on the registry is almost always an authentication problem, not a missing-package problem. The most common causes:

• The NPM_TOKEN secret has expired or been revoked.
• The token type is wrong (e.g., replaced with one that doesn't have publish scope).
• The token belongs to an account that no longer has publish permission on these packages.

Impact

No new versions of nextra, nextra-theme-docs, or nextra-theme-blog have been released to npm since the 4.6.4 line, even though many fixes have been merged to main over the past 6 months (Next.js 16 compatibility, security bumps, Pagefind basePath fix, LayoutPropsSchema fix, git worktree fix for GIT_ROOT, etc.). Users cannot consume these fixes without installing from git.

Suggested fix

Rather than just rotating NPM_TOKEN again, I'd recommend migrating this workflow to npm Trusted Publishing (OIDC), which removes the long-lived token entirely and prevents this whole class of "token silently expired" failures from recurring.

Concretely:

1. On npmjs.com, for each of nextra, nextra-theme-docs, nextra-theme-blog, configure a Trusted Publisher pointing at shuding/nextra + .github/workflows/release.yml on main.
2. Update .github/workflows/release.yml:
   • Add permissions: id-token: write to the release job (in addition to the existing contents: write / pull-requests: write).
   • Drop the NPM_TOKEN env on the publish step. The npm CLI will mint a short-lived OIDC token automatically, and provenance attestations will be attached for free.
3. Re-run the latest failed workflow (Version Packages (#4997), run id 26580877266), or merge a refreshed Version Packages PR.

If switching to OIDC isn't desired right now, the short-term fix is just rotating NPM_TOKEN to a fresh Automation token with publish scope on all three packages — but the underlying secret will keep expiring.