From 973bc0116bd13a66e1fc472ef12fe569bf49d5c9 Mon Sep 17 00:00:00 2001 From: Jamie Holding Date: Wed, 15 Apr 2026 12:40:36 +0000 Subject: [PATCH 1/2] ci: bump npm before publish for OIDC trusted publishing Node 20 ships with npm 10.x, which predates trusted-publishing support. The v7.0.0-alpha.0 release hit E404 on PUT because the publish command fell back to the placeholder NODE_AUTH_TOKEN setup-node injects when no real token is configured. npm >= 11.5.1 natively understands OIDC trusted publishing. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 398f7af..f53cf51 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,6 +19,7 @@ jobs: node-version: 20 cache: npm registry-url: https://registry.npmjs.org + - run: npm install -g npm@latest # trusted publishing requires npm >= 11.5.1 - run: npm ci - run: npm run lint && npm run typecheck && npm test && npm run build - run: npm publish --provenance --access public From 64925a99be4b31f7b541e0790af69f6cb2fa60e3 Mon Sep 17 00:00:00 2001 From: Jamie Holding Date: Wed, 15 Apr 2026 12:43:27 +0000 Subject: [PATCH 2/2] ci: prettier fix --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f53cf51..94141fc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: node-version: 20 cache: npm registry-url: https://registry.npmjs.org - - run: npm install -g npm@latest # trusted publishing requires npm >= 11.5.1 + - run: npm install -g npm@latest # trusted publishing requires npm >= 11.5.1 - run: npm ci - run: npm run lint && npm run typecheck && npm test && npm run build - run: npm publish --provenance --access public