From 279fb9d2039854ec790fc402a2995ed1cc90c6f6 Mon Sep 17 00:00:00 2001
From: AHMET BAYHAN BAYRAMOGLU <49499275+ABB65@users.noreply.github.com>
Date: Thu, 9 Jul 2026 12:47:10 +0300
Subject: [PATCH] ci: pin npm to 11.18.0 for trusted publishing (fix sigstore
 publish failure)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Release job upgraded npm via `npm install -g npm@latest`, which now
resolves to npm 12.0.0. npm 12.0.0 ships libnpmpublish's provenance.js —
which `require('sigstore')` — but does NOT bundle the sigstore module, so
`changeset publish` fails during provenance generation with
"npm error Cannot find module 'sigstore'" and no packages are published
(run 29007036403). Verified by unpacking the tarballs: sigstore is bundled
in npm 11.5.1 and 11.18.0, missing in 12.0.0.

Pin to npm@11.18.0 (latest 11.x, >= the 11.5.1 trusted-publishing minimum,
sigstore bundled). Merging this to main re-triggers Release, which publishes
the already-versioned-but-unpublished packages (mcp@1.7.0, contentrain@0.7.0,
types@0.7.0, query@6.1.1, rules@0.5.3, skills@0.5.3).
---
 .github/workflows/release.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 62fb932..a98e3ed 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,8 +39,12 @@ jobs:
           registry-url: https://registry.npmjs.org
 
       # Node 22 ships npm 10.x; npm trusted publishing (OIDC) requires >= 11.5.1.
+      # Pinned to 11.x on purpose: npm 12.0.0 ships libnpmpublish's
+      # provenance.js but does NOT bundle its `sigstore` dependency, so
+      # `changeset publish` dies with "Cannot find module 'sigstore'" while
+      # generating provenance. 11.18.0 bundles sigstore correctly.
       - name: Upgrade npm for trusted publishing (OIDC)
-        run: npm install -g npm@latest
+        run: npm install -g npm@11.18.0
 
       - name: Configure git for tests
         run: |