fix(ci): use Node 20 + npm@latest for OIDC publish - #16
Conversation
Node 22.22.2 on GitHub Actions has a broken npm (missing promise-retry module) that can't self-upgrade. Even pinning to Node 22.11.0, the bundled npm v10.x fails OIDC provenance publishing with 404. Switch to Node 20 + npm@latest (v11.x) which is the exact combination that successfully published v1.0.0 on March 18.
abc2b00 to
45e74df
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abc2b00c6f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| registry-url: "https://registry.npmjs.org" | ||
|
|
||
| - name: Upgrade npm | ||
| run: npm install -g npm@latest |
There was a problem hiding this comment.
Installing npm@latest makes the publish pipeline non-deterministic and can break the release job as soon as npm's latest tag requires a newer Node runtime than the pinned Node 20 runner. In this workflow, that failure would occur before npm ci, blocking all releases on main/beta; pinning npm to a tested major/minor avoids unexpected breakage from upstream npm tag changes.
Useful? React with 👍 / 👎.
|
🎉 This PR is included in version 1.1.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
2 participants
Node 22 on GHA runners is broken for npm publish. Switch to Node 20 + npm@latest which is the exact combination that published v1.0.0 successfully.