From 02d65a790ad33e6528aa3a28970b5ab6015250db Mon Sep 17 00:00:00 2001 From: Ryan Carniato Date: Sun, 6 Sep 2026 02:01:49 -0700 Subject: [PATCH] ci: npm >= 11.5.1 in the release job so OIDC trusted publishing works changeset publish hands off to the npm CLI, and the OIDC token exchange lives there from 11.5.1. Node 22's bundled npm 10 sent an unauthenticated PUT and the registry answered E404 for both packages. Co-authored-by: Cursor --- .github/workflows/release.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 29d5b5b..475d906 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,6 +35,11 @@ jobs: # repo + this workflow file registered as a Trusted Publisher on # npmjs.com. npm only allows that on an EXISTING package, so the first # publish of each name is a manual `pnpm release` by a maintainer. + # + # The OIDC exchange lives in the npm CLI itself and needs npm >= 11.5.1; + # with an older npm the PUT goes out unauthenticated and the registry + # answers E404. Node 22 bundles npm 10, hence Node 24 plus an explicit + # upgrade rather than trusting whatever the runner image bundles. release: needs: test runs-on: ubuntu-latest @@ -43,9 +48,11 @@ jobs: - uses: pnpm/action-setup@v4 - uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 24 cache: pnpm registry-url: https://registry.npmjs.org + - name: npm with trusted publishing support + run: npm install -g npm@latest && npm --version - run: pnpm install --frozen-lockfile - name: Create Release Pull Request or Publish to npm uses: changesets/action@v1