fix: pin the release npm to the 11 line - #20
Merged
Merged
Conversation
The release workflow installed `npm@latest` to get an npm new enough for
trusted publishing. That floated to npm 12, which requires Node
`^22.22.2 || ^24.15.0 || >=26.0.0` and so refuses to run on the Node 20
this job uses:
npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error notsup Actual: {"npm":"10.8.2","node":"v20.20.2"}
The step meant to guarantee OIDC support was the step that broke the job,
and it failed before reaching anything else. Found by dispatching the
workflow deliberately rather than discovering it during a real release.
OIDC publishing needs npm >= 11.5.1, not the newest npm, and the 11 line
still supports Node 20. Pinning also stops the next npm major from
breaking releases the same way.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dispatching the Release workflow deliberately — rather than finding out during a real release — surfaced a defect in it.
The workflow installed
npm@latestto get an npm new enough for trusted publishing. That now floats to npm 12, which requires Node^22.22.2 || ^24.15.0 || >=26.0.0and refuses to run on the Node 20 this job uses:So the step meant to guarantee OIDC support was the step breaking the job, and it failed before reaching the version guard, the publish, or anything else. Failing run
OIDC publishing needs npm >= 11.5.1, not the newest npm, and the 11 line still supports Node 20. Pinning also stops the next npm major from breaking releases this same way.
Note this leaves the OIDC handshake itself still unproven — the smoke test can only reach the version guard, since
mft-config@0.1.0is already published. That gets exercised on the first real release, where a manualnpm publishremains the fallback.🤖 Generated with Claude Code