From cb51b782b374e8321ed771a4025647eb504cc097 Mon Sep 17 00:00:00 2001 From: chrisli30 Date: Mon, 20 Jul 2026 21:54:36 -0700 Subject: [PATCH] fix(ci): pin release npm to 11.x so trusted publishing works on Node 20 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Release workflow's "Upgrade npm for trusted publishing" step ran `npm install --global npm@latest`. npm@latest rolled to 12.0.1, which dropped Node 20 support (requires Node ^22.22.2 || ^24.15.0 || >=26.0.0), so the step now fails with EBADENGINE on the Node 20 runner: npm error EBADENGINE Required: {"node":"^22.22.2 || ..."} Actual: {"npm":"10.8.2","node":"v20.20.2"} That aborts the Release job before changesets/action can open the "chore: version packages" PR (or publish), silently stalling releases. Pin to `npm@^11.5.1` — the 11.x line supports Node 20.17+ and already has OIDC trusted publishing (>= 11.5.1), restoring the release flow without a Node bump. Comment notes to raise npm + node-version together when moving to npm 12+. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5cc6d00..5708575 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,11 +42,18 @@ jobs: - name: Upgrade npm for trusted publishing # Trusted Publishing requires npm >= 11.5.1. setup-node@v4 doesn't - # expose a built-in `npm-version` knob, so we install the latest - # CLI explicitly. `npm publish` (called by `changeset publish`) - # then auto-detects the OIDC environment and authenticates against - # npm without an NPM_TOKEN. - run: npm install --global npm@latest + # expose a built-in `npm-version` knob, so we install a newer CLI + # explicitly. `npm publish` (called by `changeset publish`) then + # auto-detects the OIDC environment and authenticates against npm + # without an NPM_TOKEN. + # + # Pin to the 11.x line rather than `@latest`: npm@12 dropped Node + # 20 support (requires Node ^22.22.2 || ^24.15.0 || >=26.0.0), so + # `npm@latest` fails with EBADENGINE on the Node 20 runner above. + # npm 11.x supports Node 20.17+ and already has OIDC trusted + # publishing. Bump this (and node-version) together if moving to + # npm 12+. + run: npm install --global "npm@^11.5.1" - name: Install dependencies run: yarn install --frozen-lockfile