From 602e19d39ed2a3664bd9df110c7358659d77bc08 Mon Sep 17 00:00:00 2001 From: Brian Leishman Date: Wed, 8 Jul 2026 18:03:21 -0400 Subject: [PATCH] =?UTF-8?q?ci:=20pin=20npm=20to=20the=2011.x=20major=20in?= =?UTF-8?q?=20publish-npm=20=E2=80=94=20npm@latest=20broke=20provenance?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v0.2.2 release's publish-npm job failed twice with "Cannot find module 'sigstore'" from libnpmpublish's provenance path after `npm install -g npm@latest` over Node 22's bundled npm. Trusted publishing needs npm >= 11.5, so pin the known-good major instead of tracking latest. Co-Authored-By: Claude Fable 5 (1M context) --- .github/workflows/release.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0a47cc2..e89bb43 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -190,8 +190,10 @@ jobs: node-version: 22 registry-url: https://registry.npmjs.org # Auth is npm trusted publishing (OIDC) — no token. Requires npm >= 11.5, - # newer than what ships with the runner's Node. - - run: npm install -g npm@latest + # newer than what ships with the runner's Node. Pinned to the 11.x major: + # npm@latest self-installed over Node 22's npm broke provenance with + # "Cannot find module 'sigstore'" (v0.2.2 release). + - run: npm install -g npm@11 - name: Publish to npm run: | set -euo pipefail