ci: upgrade npm in publish step — OIDC trusted publishing needs npm >= 11.5#5
Merged
Merged
Conversation
… 11.5 The v3.0.0 release run failed at the publish step with ENEEDAUTH: every gate passed, but Node 22's bundled npm 10.9 predates npm trusted publishing, so the OIDC exchange never happened. Upgrading npm to latest in the publish step enables the trusted-publisher flow (no token needed; takes precedence), while an NPM_TOKEN secret keeps working as a fallback for the classic path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013eq96Mbqa2dBCAN3YCyrDK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the failed
v3.0.0publish run (#29210915884).Diagnosis: every gate passed (tag guard, unit + type suite, 500 fuzz scenarios, CJS + ESM tarball smokes — the packed tarball was byte-perfect, 8 files), then
npm publishfailed withENEEDAUTH. The runner's Node 22 bundles npm 10.9, which predates npm's OIDC trusted publishing — so if npm is connected via a trusted publisher on npmjs.com, the OIDC token exchange never happens and npm has no credentials at all.Fix: upgrade npm to latest inside the publish step before
npm publish --provenance. With a trusted publisher configured this authenticates via OIDC (no token needed — it takes precedence); a classicNPM_TOKENActions secret continues to work as a fallback.One step changed in
.github/workflows/publish.yml; no package code changes. Note: re-running the failed release run would use the old workflow snapshot — after merging, trigger a fresh run instead (workflow_dispatchon thev3.0.0tag).🤖 Generated with Claude Code
Generated by Claude Code