From b7b57c6c3a9d0964f704c17f73a36c7a78ee4f6a Mon Sep 17 00:00:00 2001 From: oveddan Date: Mon, 31 Aug 2026 16:20:05 -0700 Subject: [PATCH] fix: pin the release npm to the 11 line The release workflow installed `npm@latest` to get an npm new enough for trusted publishing. That floated to npm 12, which requires Node `^22.22.2 || ^24.15.0 || >=26.0.0` and so refuses to run on the Node 20 this job uses: npm error notsup Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"} npm error notsup Actual: {"npm":"10.8.2","node":"v20.20.2"} The step meant to guarantee OIDC support was the step that broke the job, and it failed before reaching anything else. Found by dispatching the workflow deliberately rather than discovering it during a real release. OIDC publishing needs npm >= 11.5.1, not the newest npm, and the 11 line still supports Node 20. Pinning also stops the next npm major from breaking releases the same way. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0189d58..4505169 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,9 +34,13 @@ jobs: cache: pnpm registry-url: https://registry.npmjs.org - # setup-node pins an npm that predates OIDC publishing on some images. + # The Node 20 image ships npm 10, which predates OIDC publishing; trusted + # publishing needs >= 11.5.1. Pinned to the 11 line on purpose: `npm@latest` + # is npm 12, which refuses to run on Node 20 and fails this step outright. - name: Use an npm that supports trusted publishing - run: npm install -g npm@latest + run: | + npm install -g npm@^11.5.1 + npm --version - run: pnpm install --frozen-lockfile