[BUG] use `pull_request_target` trigger OIDC publish failing from GitHub actions

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

name: "Publish Dev Preview on PR Merge"

on:
  pull_request_target:
    types: [closed]
    paths:
      - "packages/**"

permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write

jobs:
  npm-preview:

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: lts/*
          registry-url: https://registry.npmjs.org/
          cache: yarn

      - name: Install and build
          .....

      - name: npm publish
        run: npm publish --tag latest --provenance --access public 

Expected Behavior

Steps To Reproduce

When I changed pull_request_target to push, it was successfully triggered.

Environment

use github action ci

Start with the shown GitHub Actions workflow, especially the pull_request_target trigger, actions/setup-node@v4, and npm publish --provenance step. Compare the failing trigger with push and inspect the OIDC and provenance requirements; done means a reproducible workflow publishes successfully with the intended trigger.