From 2bba88ac86f77fd3f1400c98cb55b0a0d220e6bb Mon Sep 17 00:00:00 2001 From: Luke Macauley Date: Thu, 9 Jul 2026 18:15:46 +0200 Subject: [PATCH] fix(ci): pin npm@11 for publish + add workflow_dispatch npm@12 (the current @latest) ships a broken provenance path that fails with "Cannot find module 'sigstore'", breaking npm publish. Pin npm@11, which published every release through 0.13.0. Add workflow_dispatch so a version whose release already fired (v0.14.1) can be published from main without cutting a new tag (immutable releases burn a tag on the failed release). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5803ae0..9bbe68f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,6 +3,7 @@ name: Publish to npm on: release: types: [published] + workflow_dispatch: # manual publish of the current package.json version on the selected ref jobs: publish: @@ -23,10 +24,11 @@ jobs: node-version: "24" registry-url: "https://registry.npmjs.org" - # OIDC trusted publishing needs a recent npm. npm@latest dropped Node 20 - # (npm@12 requires Node >=22.22 || >=24.15), so this runs on Node 24. + # OIDC provenance needs a recent npm. Pinned to npm@11 (not @latest): npm@12 + # ships a broken provenance path that can't resolve its `sigstore` dependency. + # npm@11 is what published every release through 0.13.0. - name: Upgrade npm for OIDC support - run: npm install -g npm@latest + run: npm install -g npm@11 - name: Install dependencies run: pnpm install --frozen-lockfile