From a09da593b489a442c8462f4075c539ad7cd02ec1 Mon Sep 17 00:00:00 2001 From: xNet Test Date: Fri, 10 Jul 2026 08:53:45 -0700 Subject: [PATCH] =?UTF-8?q?ci(release):=20pin=20npm=2011.x=20=E2=80=94=20n?= =?UTF-8?q?pm=2012.0.0=20ships=20without=20sigstore,=20breaking=20provenan?= =?UTF-8?q?ce=20publish?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: xNet Test --- .github/workflows/npm-release.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml index 70b3f91bd..dd825bdf6 100644 --- a/.github/workflows/npm-release.yml +++ b/.github/workflows/npm-release.yml @@ -31,10 +31,13 @@ jobs: node-version: '24' registry-url: 'https://registry.npmjs.org' - # Trusted publishing (OIDC) requires npm CLI >= 11.5.1. Pin latest so the - # token-less publish + provenance path is always available. (Exploration 0220.) + # Trusted publishing (OIDC) requires npm CLI >= 11.5.1. Pin the 11.x line: + # `npm@latest` bit us the day npm 12.0.0 shipped with a build missing the + # `sigstore` module its own provenance path requires (MODULE_NOT_FOUND on + # every `--provenance` publish). Bump this pin deliberately once a 12.x + # publish has been verified. (Explorations 0220, 0291 follow-up.) - name: Ensure npm supports trusted publishing - run: npm install -g npm@latest + run: npm install -g npm@11 - name: Create release PR or publish id: changesets