fix: pin npm to v11 and bump Node to 22.x to avoid npm@latest engine break

.github/workflows/maven.yml

@@ -33,9 +33,11 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: '20.x'
+        node-version: '22.x'
     - name: Upgrade npm for trusted publishing
-      run: npm install -g npm@latest
+      # Pin the npm major version instead of tracking npm@latest so a new npm
+      # release with a higher Node engine requirement can't break this step.
+      run: npm install -g npm@11
     - name: Install PHP
       run: |
         brew update

action.yml

@@ -119,12 +119,16 @@ runs:
       if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' }}
       uses: actions/setup-node@v4
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         registry-url: 'https://registry.npmjs.org'
 
     - name: Upgrade npm for trusted publishing
-      if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' }}
-      run: npm install -g npm@latest
+      # Only needed for npm trusted publishing (OIDC provenance); GitHub
+      # releases don't use it. Pin the major version rather than tracking
+      # npm@latest so a new npm release with a higher Node engine requirement
+      # can't break this step without a Node bump here.
+      if: ${{ env.JDEPLOY_SKIP_EXECUTION != 'true' && inputs.deploy_target == 'npm' }}
+      run: npm install -g npm@11
       shell: bash
 
     - name: Setup jDeploy Registry