From adba9bde19ca2f4102ffa75f60e43822d026d678 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jay=20P=C3=A9clard?= Date: Fri, 10 Jul 2026 12:44:43 +0200 Subject: [PATCH] ci: pin publish-step npm to the 11.x line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm 12.0.0 (current latest) fails `npm publish` under OIDC Trusted Publishing with MODULE_NOT_FOUND on 'sigstore' in libnpmpublish's provenance path — this is what broke the v0.4.0 publish. Node 24's bundled npm is already 11.16.0, so 11.x comfortably clears the >= 11.5.1 Trusted Publishing floor. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_012rn1KYa8uH8ikwK3AaHaLP --- .github/workflows/release-please.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 75989ae..00088c3 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -56,10 +56,14 @@ jobs: - name: Build run: yarn prepare - - name: Ensure npm >= 11.5.1 (Trusted Publishing) + # npm 12.0.0 ships a libnpmpublish that fails OIDC/provenance publishes + # with MODULE_NOT_FOUND on 'sigstore' (broke the v0.4.0 release), so + # stay on the 11.x line — it satisfies the >= 11.5.1 Trusted + # Publishing floor. + - name: Ensure npm 11.x >= 11.5.1 (Trusted Publishing) run: | npm --version - npm install -g npm@latest + npm install -g npm@11 npm --version - name: Publish