[Credgate]

The release workflow publishes tokenless via OIDC trusted publishing, but pnpm 9.15 has no native OIDC support, so its publish delegated to npm and leaked pnpm's own --no-git-checks flag, aborting publish with EUNKNOWNCONFIG. pnpm 11.20 does trusted publishing and provenance natively.

Aligns the toolchain with the ui repo: node 24.19.0 / pnpm 11.20.0 via a shared .tool-versions file. Adds allowBuilds for esbuild (pnpm 11 blocks dependency lifecycle scripts by default) and drops the manual npm upgrade step, now redundant since node 24 bundles npm 11.x and pnpm publishes directly.

[Copilot]

Pull request overview

Updates the repository’s Node.js and pnpm toolchain to enable tokenless OIDC trusted publishing/provenance with pnpm (avoiding npm delegation issues) and to align versions with the UI repo.

Changes:

• Pin pnpm to 11.20.0 and tighten Node engine to 24.19.0 < 25 in package.json.
• Add .tool-versions and switch GitHub Actions to read Node version from it.
• Add allowBuilds for esbuild to accommodate pnpm 11’s default build-script restrictions, and remove the redundant npm-upgrade step from the release workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-workspace.yaml	Allows esbuild lifecycle scripts under pnpm 11 via allowBuilds.
package.json	Pins pnpm version and updates Node/pnpm engine constraints.
.tool-versions	Introduces a shared Node/pnpm version source for local tooling and CI.
.github/workflows/release.yml	Uses .tool-versions for Node selection and removes npm upgrade step.
.github/workflows/ci.yml	Uses .tool-versions for Node selection in CI jobs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.