From f74d200b1610a446e4c21d3e5d057a461e0f3829 Mon Sep 17 00:00:00 2001
From: "omegent-app[bot]" <306514130+omegent-app[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 12:51:05 +0000
Subject: [PATCH] ci: drop npm@latest upgrade that breaks OIDC publish job

npm@12 requires Node ^24.15; setup-node 24.14 ships npm 11.11 which
already satisfies trusted publishing (>=11.5.1). Remove the global
upgrade step from the release.oidc.yaml template so the version job
can reach publish after re-copying to workflows/release.yaml.
---
 .github/npm-trusted-publishing.md |  3 +--
 .github/release.oidc.yaml         | 13 ++++++-------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/.github/npm-trusted-publishing.md b/.github/npm-trusted-publishing.md
index 981913178..3b383adc5 100644
--- a/.github/npm-trusted-publishing.md
+++ b/.github/npm-trusted-publishing.md
@@ -82,8 +82,7 @@ git push
 That workflow includes:
 
 - `permissions.id-token: write`
-- npm CLI upgraded to latest (≥ `11.5.1` required for OIDC)
-- Node `24.14`
+- Node `24.14` (ships npm ≥ `11.5.1`, which is enough for OIDC — do **not** `npm i -g npm@latest`; npm 12 needs Node ≥ `24.15`)
 - **No** `NPM_TOKEN` on the publish step
 - Package `repository.url` points at `https://github.com/effect-app/libs.git` (set in package.json)
 
diff --git a/.github/release.oidc.yaml b/.github/release.oidc.yaml
index 7a0426788..bb80a11ed 100644
--- a/.github/release.oidc.yaml
+++ b/.github/release.oidc.yaml
@@ -1,6 +1,7 @@
-# Intended contents of .github/workflows/release.yaml for npm Trusted Publishing (OIDC).
-# Apply with: cp .github/release.oidc.yaml .github/workflows/release.yaml
-# (Bot cannot push workflow file updates; a maintainer must apply this once.)
+# Canonical Changesets workflow using npm Trusted Publishing (OIDC).
+# Live path: .github/workflows/release.yaml
+# If they diverge, prefer this file and copy:
+#   cp .github/release.oidc.yaml .github/workflows/release.yaml
 name: Changesets
 on:
   push:
@@ -34,13 +35,11 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v4
         with:
+          # Keep on a Node line that ships npm >= 11.5.1 (OIDC trusted publishing).
+          # Do not `npm i -g npm@latest` here: npm 12 requires Node ^24.15 / ^22.22.
           node-version: 24.14
           registry-url: https://registry.npmjs.org
 
-      # Trusted publishing requires npm CLI >= 11.5.1
-      - name: Ensure npm supports OIDC trusted publishing
-        run: npm install -g npm@latest && npm --version
-
       - uses: pnpm/action-setup@v3
         name: Install pnpm
         id: pnpm-install