package-registry-manager 0.24.0 → 0.25.0

package/README.md

@@ -70,3 +70,10 @@ local `--offline` commands keep local scope. Both CLIs' GitHub dependency needs
 Node.js 22.12 or newer and npm; JavaScript checks the runtime before loading it.
 
 See the [bootstrap, wrapper and credential guide](../docs/registry-setup.md) for branch/PR setup, dual npm names, registry policies and integration limits.
+
+Migration tries trusted publishing first and retains token fallback and expiry
+metadata by default. `--delete-token-secrets` explicitly opts into cleanup after
+OIDC publication and verification that no workflow still uses the credentials.
+Saved crates.io API sessions run headlessly; sign-in opens a visible window only
+when user action is needed. Organization migration skips and reports scan errors
+while continuing for clean repositories.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -40,9 +40,9 @@
     "audit": "node scripts/npm-audit.mjs"
   },
   "dependencies": {
-    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
+    "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/293e9a8ab9d6d91a08e95f4e09c2a0dcad9bc809",
     "browser-commander": "^0.34.0",
-    "command-stream": "^2.4.0",
+    "command-stream": "^2.6.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/automation.mjs

@@ -29,14 +29,20 @@ export function relayExtensionDirectory() {
  * the `domains` import scope only the cookies of `domains`, the registry's
  * sign-in domains, are imported.
  */
-export function launchOptions(browser, profile, verbose = false, domains = []) {
+export function launchOptions(
+  browser,
+  profile,
+  verbose = false,
+  domains = [],
+  headless = false,
+) {
   const options = {
     engine:
       findBrowserSource(browser.channel)?.controlProtocol === "cdp"
         ? "playwright"
         : "selenium",
     channel: browser.channel,
-    headless: false,
+    headless,
     verbose,
   };
   if (browser.executable) {
@@ -82,7 +88,7 @@ export function extensionInstructions(directory) {
  * `evaluate`, `close`, and, for a launched profile, `clearCookies(domains)`.
  */
 export async function connectAutomation(
-  { browser, profile, verbose = false, domains = [] },
+  { browser, profile, verbose = false, domains = [], headless = false },
   dependencies = {},
 ) {
   if (browser.attach?.mode === "extension") {
@@ -90,7 +96,7 @@ export async function connectAutomation(
   }
   if (findBrowserSource(browser.channel)?.controlProtocol === "bidi") {
     return connectWebDriverAutomation(
-      { browser, profile, verbose, domains },
+      { browser, profile, verbose, domains, headless },
       dependencies,
     );
   }
@@ -99,8 +105,9 @@ export async function connectAutomation(
   }
   const connection = await (
     dependencies.launchRealBrowser ?? launchRealBrowser
-  )(launchOptions(browser, profile, verbose, domains));
+  )(launchOptions(browser, profile, verbose, domains, headless));
   return {
+    headless,
     goto: (url) => connection.page.goto(url),
     evaluate: (script) => connection.page.evaluate(script),
     close: () => connection.close(),

package/src/browser.mjs

@@ -42,10 +42,10 @@ export function openerSucceeded(file, code) {
  * Starts an opener through command-stream without a shell and settles once it
  * exits, or after `graceMs` while it keeps running in the background.
  */
-export function detachedRunner(graceMs = OPENER_GRACE_MS) {
+export function detachedRunner(graceMs = OPENER_GRACE_MS, spawnChild = spawn) {
   return (file, args) =>
     new Promise((resolve, reject) => {
-      const child = spawn(file, args, {
+      const child = spawnChild(file, args, {
         detached: process.platform !== "win32",
         stdio: "ignore",
         shell: false,

package/src/cli-main.mjs

@@ -36,7 +36,8 @@ Global options:
   --org <org> | --user <login>      Scan repositories through gh-manager
   --secret-name <template>         Secret name; supports {REGISTRY}, {REPO}, {ORG}
   --rotate-token <secret>          Explicitly replace a legacy crates.io token
-  --migrate                       Convert token jobs in PRs, then verify OIDC and clean up secrets
+  --migrate                       Convert jobs to OIDC with token fallback, then verify releases
+  --delete-token-secrets          Opt in to verified unused token and expiry cleanup
   --token-expiry-days <N>          Read browser token inventory in account scans
   --format <text|json>            Output format (default: text)
   --offline                       Do not look up packages on registries
@@ -118,6 +119,7 @@ export async function main(args = process.argv.slice(2)) {
       "secret-name": { type: "string" },
       "rotate-token": { type: "string" },
       migrate: { type: "boolean", default: false },
+      "delete-token-secrets": { type: "boolean", default: false },
       "token-expiry-days": { type: "string" },
       format: { type: "string", default: "text" },
       verbose: { type: "boolean", default: false },
@@ -273,6 +275,7 @@ export async function main(args = process.argv.slice(2)) {
         secretName: values["secret-name"],
         rotateToken,
         migrate: values.migrate,
+        deleteTokenSecrets: values["delete-token-secrets"],
         tokenExpiryDays,
         package: values.package,
         browser: values.browser,
@@ -288,6 +291,7 @@ export async function main(args = process.argv.slice(2)) {
           publisherEnvironment: values.environment,
           addPublishJob: values["add-publish-job"],
           migrate: values.migrate,
+          deleteTokenSecrets: values["delete-token-secrets"],
           manual: values.manual,
           verifyRelease: values["verify-release"],
         },
@@ -331,6 +335,7 @@ export async function main(args = process.argv.slice(2)) {
   const planOptions = {
     rotateToken,
     migrate: values.migrate,
+    deleteTokenSecrets: values["delete-token-secrets"],
     ref: values.ref,
     verifyRelease: values["verify-release"],
     manual: values.manual,
@@ -375,9 +380,10 @@ export async function main(args = process.argv.slice(2)) {
   }
 
   const plans = buildPlans(inspection, registries, planOptions);
-  const selected = values.all
-    ? plans.filter((plan) => plan.package.publishable)
-    : [selectPlan(plans, values.package)];
+  const selected =
+    values.all || (values.migrate && !values.package)
+      ? plans.filter((plan) => plan.package.publishable)
+      : [selectPlan(plans, values.package)];
   outputPlans(selected, values.format);
   await executePlans(
     selected,
@@ -394,6 +400,7 @@ export async function main(args = process.argv.slice(2)) {
       secretName: values["secret-name"],
       rotateToken,
       migrate: values.migrate,
+      deleteTokenSecrets: values["delete-token-secrets"],
       quietBrowser: selected.some((plan) =>
         plan.steps.some((step) =>
           ["manage-registry-token", "rotate-crates-token"].includes(step.id),
@@ -408,7 +415,7 @@ export async function main(args = process.argv.slice(2)) {
       verbose: values.verbose,
       verifyRelease: values["verify-release"],
     },
-    values.all,
+    values.all || values.migrate,
   );
 }
 
@@ -520,7 +527,14 @@ function outputInspection(inspection, format) {
         packageInfo.exists_on_registry ? "published" : "not published yet",
       );
     }
-    if (packageInfo.trusted_publishing) {
+    if (packageInfo.registry_http_status) {
+      details.push(
+        `registry state unknown (HTTP ${packageInfo.registry_http_status})`,
+      );
+    }
+    if (packageInfo.publishing_policy === "oidc-with-token-fallback") {
+      details.push("trusted publishing + token fallback");
+    } else if (packageInfo.trusted_publishing) {
       details.push("trusted publishing");
     }
     process.stdout.write(

package/src/crates-api.mjs

@@ -350,11 +350,15 @@ export async function runCratesApiStep(session, step) {
   }
   const crate = plan.package.name;
   const domains = signInDomains(plan.registry);
-  let page = await session.automatedPage();
+  let page = await session.automatedPage(undefined, false, true);
   switch (step.id) {
     case "crates-sign-in": {
       await page.goto(CRATES_IO_URL);
-      if (!(await readSession(page)).signedIn) {
+      const saved = await readSession(page);
+      if (!saved.signedIn || !saved.emailVerified) {
+        page = await session.visiblePage();
+      }
+      if (!saved.signedIn) {
         // Whether imported or signed in by hand, the sign-in is this run's.
         conditions.add("crates-signed-in");
         if (await offerSignInImport(session, domains)) {
@@ -362,6 +366,9 @@ export async function runCratesApiStep(session, step) {
         }
       }
       await signIn(page, options);
+      console.log(
+        "Using your crates.io session to register trusted publishers; no action needed while API requests run.",
+      );
       return;
     }
     case "first-publish": {

package/src/discovery.mjs

@@ -246,6 +246,9 @@ function withPublisher(item, workflows, publishers) {
     return item;
   }
   const result = { ...item };
+  if (publisher.policy) {
+    result.publishing_policy = publisher.policy;
+  }
   if (publisher.workflow) {
     result.workflow = publisher.workflow;
   }
@@ -266,7 +269,9 @@ function withPublisher(item, workflows, publishers) {
           `no workflow publishes ${item.name} to ${item.registry}; CI releases will not reach it`,
         ]
       : []),
-    ...secrets.map((secret) => tokenSecretWarning(item.registry, secret)),
+    ...secrets
+      .filter(() => publisher.policy !== "oidc-with-token-fallback")
+      .map((secret) => tokenSecretWarning(item.registry, secret)),
   ];
   if (warnings.length > 0) {
     result.warnings = [...(item.warnings ?? []), ...warnings];

package/src/github.mjs

@@ -1,3 +1,4 @@
+import { delay, retryDelay } from "./request-policy.mjs";
 import {
   createRestClient,
   resolveToken,
@@ -15,7 +16,9 @@ export function githubServices(options = {}) {
       "sign in to GitHub with gh auth login before scanning or setting secrets",
     );
   }
-  const rest = options.rest ?? createRestClient({ token });
+  const rest =
+    options.rest ??
+    createRestClient({ token, fetch: retryingGithubFetch(options) });
   const log = {
     debug: (message) => {
       if (options.verbose) {
@@ -41,3 +44,33 @@ export function githubServices(options = {}) {
     },
   };
 }
+
+/** Retry rate-limited reads before gh-manager consumes response headers. */
+export function retryingGithubFetch(options = {}) {
+  return async (url, init = {}) => {
+    const fetcher = options.githubFetch ?? globalThis.fetch;
+    for (let attempt = 0; ; attempt++) {
+      const response = await fetcher(url, init);
+      if (
+        ![403, 429].includes(response.status) ||
+        attempt >= 3 ||
+        !["GET", "HEAD"].includes(init.method ?? "GET")
+      ) {
+        return response;
+      }
+      const reset =
+        Number(response.headers?.get("x-ratelimit-reset")) * 1000 - Date.now();
+      const wait = Math.max(
+        retryDelay(response.headers?.get("retry-after"), attempt),
+        Number.isFinite(reset) ? reset : 0,
+      );
+      if (options.verbose) {
+        console.error(
+          `GitHub read rate limited (HTTP ${response.status}); retry ${attempt + 1} in ${wait}ms`,
+        );
+      }
+      await response.body?.cancel();
+      await (options.sleep ?? delay)(wait);
+    }
+  };
+}

package/src/migration-cleanup.mjs

@@ -36,11 +36,22 @@ export function publishedThroughOidc(job, log, registry) {
       ) && /Published\s+\S+\s+v\d/.test(log)
     );
   }
+  if (steps.some((step) => /token fallback/i.test(step.name))) {
+    return false;
+  }
   if (registry === "npm") {
-    return /^.*\+\s+(?:@[^/\s]+\/)?[^@\s]+@\d/m.test(log);
+    return (
+      steps.some((step) => /OIDC/i.test(step.name)) &&
+      /^.*\+\s+(?:@[^/\s]+\/)?[^@\s]+@\d/m.test(log)
+    );
   }
   if (registry === "pypi") {
-    return /Successfully uploaded|View at:\s*https:\/\/pypi\.org/.test(log);
+    return (
+      steps.some(
+        (step) =>
+          /prm_oidc|OIDC/i.test(step.name) && !/fallback/.test(step.name),
+      ) && /Successfully uploaded|View at:\s*https:\/\/pypi\.org/.test(log)
+    );
   }
   return false;
 }
@@ -80,13 +91,6 @@ export async function cleanupMigratedSecrets(session) {
   ];
   const current = await defaultWorkflows(github, slug);
   const stillRead = names.filter((name) => readsSecret(current.files, name));
-  if (stillRead.length) {
-    session.outcome = { status: "migration-required" };
-    console.log(
-      `${slug} still reads ${stillRead.join(", ")}; merge the conversion PR before cleanup.`,
-    );
-    return;
-  }
   const workflow = plan.trusted_publisher?.workflow ?? plan.package.workflow;
   const runs = await github.runs.list(slug, {
     workflow,
@@ -124,6 +128,24 @@ export async function cleanupMigratedSecrets(session) {
     );
     return;
   }
+  if (!options.deleteTokenSecrets) {
+    session.outcome = {
+      status: "fallback-retained",
+      oidc_verified: true,
+      fallback_secrets: stillRead,
+    };
+    console.log(
+      `${slug}: OIDC publication verified; token secrets (${stillRead.join(", ") || "none referenced"}) and expiry metadata retained for fallback. Use --delete-token-secrets only after removing every consumer.`,
+    );
+    return;
+  }
+  if (stillRead.length) {
+    session.outcome = { status: "migration-required" };
+    console.log(
+      `${slug} still reads ${stillRead.join(", ")}; merge the conversion PR before cleanup.`,
+    );
+    return;
+  }
   const deletions = [];
   for (const name of names) {
     const manager = github.secrets({ repo: slug });

package/src/organization-scan.mjs

@@ -52,6 +52,13 @@ export function packageFindings(inspection) {
         manifest: item.manifest,
       };
       const findings = [];
+      if (item.exists_on_registry === undefined && item.registry_http_status) {
+        findings.push({
+          ...common,
+          type: "registry-state-unknown",
+          evidence: { http_status: item.registry_http_status },
+        });
+      }
       if (item.exists_on_registry === false) {
         findings.push({ ...common, type: "unpublished" });
       }
@@ -267,14 +274,24 @@ async function releaseHealth(github, item, findings, onError) {
       }
       const runs = [];
       for (const event of ["push", "workflow_dispatch"]) {
-        runs.push(
-          ...(await github.runs.list(item.repository, {
+        let listed;
+        try {
+          listed = await github.runs.list(item.repository, {
             workflow,
             branch: item.default_branch,
             event,
             limit: 1,
-          })),
-        );
+          });
+        } catch (error) {
+          if (!/404/.test(error.message)) {
+            throw error;
+          }
+          listed = await github.runs.list(item.repository, {
+            workflow,
+            event,
+          });
+        }
+        runs.push(...listed);
       }
       const latest = runs
         .filter(
@@ -304,10 +321,17 @@ async function releaseHealth(github, item, findings, onError) {
         evidence,
       };
       findings.push(finding);
-      evidence.matches = await github.runs.logs(latest.id, {
-        repo: item.repository,
-        grep: RELEASE_FAILURE_PATTERNS,
-      });
+      evidence.matches = await github.runs
+        .logs(latest.id, {
+          repo: item.repository,
+          grep: RELEASE_FAILURE_PATTERNS,
+        })
+        .catch((error) => {
+          if (/GitHub log download (?:404|410)/.test(error.message)) {
+            return { status: "logs-expired", matches: [] };
+          }
+          throw error;
+        });
     } catch (error) {
       onError({ stage: "release", workflow, message: error.message });
     }
@@ -351,9 +375,11 @@ export function renderScan(scan) {
       const status =
         pkg.exists_on_registry === undefined
           ? "registry state unknown"
-          : pkg.trusted_publishing === true
-            ? "published with trusted publishing"
-            : "published; trusted publishing unknown";
+          : pkg.publishing_policy === "oidc-with-token-fallback"
+            ? "trusted publishing + token fallback"
+            : pkg.trusted_publishing === true
+              ? "published with trusted publishing"
+              : "published; trusted publishing unknown";
       rows.push(`${repo.repository}\t${pkg.registry}\t${pkg.name}\t${status}`);
     }
   }

package/src/organization-setup.mjs

@@ -144,8 +144,13 @@ export async function accountCommand(command, options, outputPlans) {
     if (errors.length) {
       console.error(renderScan({ repositories: errors, findings: [] }));
     }
-    if (options.migrate && errors.length) {
-      throw new Error("migration requires a complete account scan");
+    if (options.migrate) {
+      items = items.filter((item) => !item.error);
+      for (const item of errors) {
+        console.error(
+          `Skipping migration for ${item.repository}: ${item.error}`,
+        );
+      }
     }
     const packages = items.flatMap((item) => item.inspection.packages);
     const environment = await (options.probeEnvironment ?? probeEnvironment)({
@@ -247,9 +252,6 @@ export async function accountCommand(command, options, outputPlans) {
           "some repositories could not be prepared; see scan errors",
         );
       }
-      if (options.migrate && scan.repositories.some((item) => item.error)) {
-        throw new Error("migration requires a complete account scan");
-      }
     }
     const secretRepositories = {};
     for (const plan of plans) {

package/src/plan.mjs

@@ -75,7 +75,9 @@ function buildPlan(inspection, packageInfo, options) {
   if (
     (options.migrate || options.addPublishJob) &&
     ["crates-io", "npm", "pypi"].includes(packageInfo.registry) &&
-    packageInfo.token_secrets?.length
+    (packageInfo.publishing_policy
+      ? packageInfo.publishing_policy !== "oidc-with-token-fallback"
+      : packageInfo.token_secrets?.length)
   ) {
     return basePlan(inspection, packageInfo, [
       {
@@ -84,7 +86,7 @@ function buildPlan(inspection, packageInfo, options) {
         kind: "manual",
         confirm: true,
         description:
-          "Convert existing publishing jobs and reusable callers to OIDC, preserve the release commands and environment, and remove legacy token wiring. Review and merge the PR, then re-run setup --migrate to register trust and verify an OIDC release before deleting secrets.",
+          "Convert existing publishing jobs and reusable callers to OIDC, preserve the release commands and environment, and retain token secrets as fallback. Review and merge the PR, then re-run setup --migrate to register trust and verify an OIDC release while retaining fallback secrets by default.",
       },
     ]);
   }
@@ -241,6 +243,12 @@ function flowPlan(inspection, packageInfo, options) {
         : steps.filter((item) => !BOOTSTRAP_CONDITIONS.has(item.when)),
     );
   }
+  if (!options.deleteTokenSecrets) {
+    steps = steps.filter(
+      (step) =>
+        !["confirm-oidc-cleanup", "delete-token-secret"].includes(step.id),
+    );
+  }
   if (options.migrate) {
     steps = steps.filter(
       (step) =>
@@ -252,11 +260,11 @@ function flowPlan(inspection, packageInfo, options) {
     );
     steps.push({
       id: "cleanup-migrated-secrets",
-      title: "Verify OIDC publication and clean up legacy secrets",
+      title: "Verify OIDC publication and report fallback secrets",
       kind: "api",
       confirm: true,
       description:
-        "Read the default-branch workflows and successful publishing steps at its current commit. Delete repository token secrets only after verification; delete organization secrets only after a complete fresh scan proves no remaining consumer.",
+        "Read the default-branch workflows and successful publishing steps at its current commit. Retain token secrets and expiry metadata for fallback by default. With --delete-token-secrets, delete repository secrets only after verification and proof of non-use; delete organization secrets only after a complete fresh scan proves no remaining consumer.",
     });
   }
   if (options.ref) {

package/src/publishers.mjs

@@ -1,3 +1,4 @@
+import { publishingPolicy } from "./publishing-state.mjs";
 import { readFile, realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { stripComments, commandPosition } from "./source-code.mjs";
@@ -146,6 +147,76 @@ export function parseWorkflow(contents) {
  * the trusted publisher names the workflow CI actually publishes from.
  */
 export async function detectPublisher(root, workflows, registry) {
+  const result = await detectPublisherDetails(root, workflows, registry);
+  if (
+    ["crates-io", "npm", "pypi"].includes(registry) &&
+    (result.workflow || result.candidates.length)
+  ) {
+    result.policy = await publishingPolicies(root, workflows, registry);
+    if (result.policy !== "oidc-with-token-fallback") {
+      result.warnings.push(
+        `publishing authentication is ${result.policy}; migrate to OIDC with token fallback`,
+      );
+    }
+  }
+  return result;
+}
+
+async function publishingPolicies(root, workflows, registry) {
+  const parsed = new Map(
+    workflows.map((workflow) => [
+      workflow.name,
+      parseWorkflow(workflow.contents),
+    ]),
+  );
+  const policies = [];
+  const visit = async (name, callerGrant, seen = new Set()) => {
+    if (seen.has(name) || !parsed.has(name)) {
+      return;
+    }
+    const workflow = parsed.get(name);
+    const workflowGrant = grantsIdToken(
+      childBlock(workflow.header, 0, "permissions"),
+    );
+    for (const job of workflow.jobs) {
+      const own =
+        grantsIdToken(
+          childBlock(job.lines, childIndent(job.lines), "permissions"),
+        ) ?? workflowGrant;
+      const grant =
+        callerGrant === undefined
+          ? (own ?? false)
+          : callerGrant && (own ?? true);
+      const called = LOCAL_WORKFLOW.exec(
+        job.lines.find((line) => LOCAL_WORKFLOW.test(line)) ?? "",
+      )?.[1];
+      if (called) {
+        await visit(called, grant, new Set([...seen, name]));
+      } else if (await jobPublishes(root, workflow, job, registry)) {
+        policies.push(
+          publishingPolicy(
+            [[...workflow.header, ...job.lines].join("\n")],
+            registry,
+            grant,
+          ),
+        );
+      }
+    }
+  };
+  for (const workflow of workflows) {
+    if (!onlyCalled(parsed.get(workflow.name).header)) {
+      await visit(workflow.name);
+    }
+  }
+  const unique = [...new Set(policies)];
+  return unique.length === 1
+    ? unique[0]
+    : unique.length
+      ? "mixed-authentication"
+      : "authentication-unverified";
+}
+
+async function detectPublisherDetails(root, workflows, registry) {
   const parsedWorkflows = new Map(
     workflows.map((workflow) => [
       workflow.name,
@@ -289,7 +360,7 @@ export function tokenSecrets(workflows, registry) {
 /** Explains how to replace a long-lived token secret with trusted publishing. */
 export function tokenSecretWarning(registry, { workflow, secret }) {
   return TRUSTED_REGISTRIES.includes(registry)
-    ? `${workflow} reads secrets.${secret}; publish with ${TRUSTED_PUBLISHING_HINTS.get(registry) ?? `${registry} trusted publishing (id-token: write)`} and delete the long-lived token after verification`
+    ? `${workflow} reads secrets.${secret}; publish with ${TRUSTED_PUBLISHING_HINTS.get(registry) ?? `${registry} trusted publishing (id-token: write)`} and retain a rotated token as fallback`
     : `${workflow} reads secrets.${secret}; ensure a scoped expiring publishing token through gh-manager`;
 }
 
@@ -459,6 +530,25 @@ function scriptPublishes(lines, registry) {
   ) {
     return true;
   }
+  const commands = new Set();
+  for (const line of lines) {
+    const declaration = /\b(?:const|let|var)\s+(\w+)\s*=/.exec(line);
+    if (
+      declaration &&
+      new RegExp(pattern.source).test(line.slice(declaration.index))
+    ) {
+      commands.add(declaration[1]);
+    }
+    if (
+      [...commands].some((name) =>
+        new RegExp(
+          `(?:exec(?:Sync)?|spawn(?:Sync)?|run|system)\\s*\\(\\s*${name}\\b`,
+        ).test(line),
+      )
+    ) {
+      return true;
+    }
+  }
   const patterns = SCRIPT_PATTERNS.get(registry);
   if (!patterns) {
     return false;

package/src/publishing-state.mjs

@@ -0,0 +1,37 @@
+/** Describe release authentication, independently from the last registry publication. */
+export function publishingPolicy(contents, registry, grantOverride) {
+  const text = contents.join("\n");
+  const token =
+    /secrets\.(?:CARGO_(?:REGISTRY_)?TOKEN|NPM_(?:AUTH_)?TOKEN|NODE_AUTH_TOKEN|PYPI_(?:API_)?TOKEN)/.test(
+      text,
+    );
+  const grant =
+    grantOverride ?? /id-token:\s*write|permissions:\s*write-all/.test(text);
+  const oidc =
+    grant &&
+    (registry === "crates-io"
+      ? text
+          .split(/(?=^[ \t]*- )/m)
+          .some(
+            (step) =>
+              /crates-io-auth-action@/.test(step) &&
+              !/\bif:[\s\S]*\bvars\./.test(step),
+          )
+      : registry === "pypi"
+        ? /pypa\/gh-action-pypi-publish@/.test(text)
+        : /npm publish|npm run|node .*(?:publish|release)/.test(text));
+  const fallback =
+    registry === "crates-io"
+      ? /outputs\.token\s*\|\|\s*secrets\./.test(text) &&
+        /continue-on-error:\s*true/.test(text)
+      : /outcome == 'failure'/.test(text) &&
+        /continue-on-error:\s*true/.test(text);
+  if (oidc && token && fallback) {
+    return "oidc-with-token-fallback";
+  }
+  return oidc
+    ? "oidc-only"
+    : token
+      ? "token-only"
+      : "authentication-unverified";
+}