Repository navigation
ci: unpin e2e npm CLI from npm@11 to npm@12 (closes #440) - #535
Merged
Merged
Conversation
npm 12.0.0's published bundle omitted libnpmpublish's unscoped `sigstore` dependency, so every `npm publish --provenance` in the e2e fixture job died at module load (npm/cli#9722). #438/#439 pinned `npm install -g npm@11` as a workaround, with #440 tracking the unpin. npm/cli#9740 fixed the packing bug and shipped in npm 12.0.1 (2026-07-10); the packed tarball again contains `node_modules/sigstore`. `latest` now resolves to 12.0.1. Verified locally with a fresh `npm install -g npm@latest` (→ 12.0.1) that `require.resolve('sigstore', { paths: [libnpmpublish/lib] })` resolves — the exact check that failed on 12.0.0. Kept as an explicit major (npm@12), never floating `npm@latest`, per the #438/#439 contract. The e2e fixture suite going green on this PR is the end-to-end verification. skip-changelog: CI-internal harness pin; no consumer surface Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0131HkmhYCFEQCJ4wZcGWABJ
thekevinbot
enabled auto-merge (squash)
July 16, 2026 13:42
thekevinbot
disabled auto-merge
July 16, 2026 13:42
thekevinbot
enabled auto-merge (squash)
July 16, 2026 13:42
github-actions Bot
added a commit
that referenced
this pull request
Jul 16, 2026
ci: unpin e2e npm CLI from npm@11 to npm@12 (closes #440) (#535) npm 12.0.0's published bundle omitted libnpmpublish's unscoped `sigstore` dependency, so every `npm publish --provenance` in the e2e fixture job died at module load (npm/cli#9722). #438/#439 pinned `npm install -g npm@11` as a workaround, with #440 tracking the unpin. npm/cli#9740 fixed the packing bug and shipped in npm 12.0.1 (2026-07-10); the packed tarball again contains `node_modules/sigstore`. `latest` now resolves to 12.0.1. Verified locally with a fresh `npm install -g npm@latest` (→ 12.0.1) that `require.resolve('sigstore', { paths: [libnpmpublish/lib] })` resolves — the exact check that failed on 12.0.0. Kept as an explicit major (npm@12), never floating `npm@latest`, per the #438/#439 contract. The e2e fixture suite going green on this PR is the end-to-end verification. skip-changelog: CI-internal harness pin; no consumer surface Claude-Session: https://claude.ai/code/session_0131HkmhYCFEQCJ4wZcGWABJ Co-authored-by: Claude <noreply@anthropic.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #440. Follow-up to #438 / #439.
What & why
The e2e fixture publish job pinned
npm install -g npm@11because npm 12.0.0's published bundle omittedlibnpmpublish's unscopedsigstoredependency, so everynpm publish --provenancedied at module load withMODULE_NOT_FOUND(upstream npm/cli#9722). #440 was the dated tripwire (2026-08-09) to unpin once the upstream fix shipped, sonpm@11wouldn't quietly become load-bearing.The fix has landed ahead of schedule:
npm publishresults inCannot find module 'sigstore'npm/cli#9722 is closed, fixed by fix: correct bundled sigstore from dev dependency conflict npm/cli#9740, shipped in npm 12.0.1 (2026-07-10) — the packed tarball again containsnode_modules/sigstore.npm view npm dist-tags→latestandnext-12both resolve to 12.0.1.This bumps the pin
npm@11→npm@12and rewrites the step comment to record the fix. It stays an explicit major (never floatingnpm@latest) per the #438/#439 contract, so an upstream release can only change CI's npm via a reviewed bump.Verification
Ran the exact check #440 prescribes, against a fresh
npm install -g npm@latest(→ 12.0.1) in an isolated prefix — the check that failed on 12.0.0:The end-to-end proof is the e2e fixture suite going green on this PR against real-registry OIDC provenance publishes on npm 12.
Notes
e2e-fixture-job.ymlis CI-internal), so noCHANGELOG.md/MIGRATIONS.mdentry; commit carriesskip-changelog:.🤖 Generated with Claude Code
https://claude.ai/code/session_0131HkmhYCFEQCJ4wZcGWABJ
Generated by Claude Code