Skip to content

fix(ci): pin npm@11 for publish + add workflow_dispatch #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lukemacauley merged 1 commit into from
Jul 9, 2026
Merged

fix(ci): pin npm@11 for publish + add workflow_dispatch #61

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ name: Publish to npm
on:
release:
types: [published]
workflow_dispatch: # manual publish of the current package.json version on the selected ref

jobs:
publish:
Expand All @@ -23,10 +24,11 @@ jobs:
node-version: "24"
registry-url: "https://registry.npmjs.org"

# OIDC trusted publishing needs a recent npm. npm@latest dropped Node 20
# (npm@12 requires Node >=22.22 || >=24.15), so this runs on Node 24.
# OIDC provenance needs a recent npm. Pinned to npm@11 (not @latest): npm@12
# ships a broken provenance path that can't resolve its `sigstore` dependency.
# npm@11 is what published every release through 0.13.0.
- name: Upgrade npm for OIDC support
run: npm install -g npm@latest
run: npm install -g npm@11

- name: Install dependencies
run: pnpm install --frozen-lockfile
Expand Down
Loading