Skip to content

Fix npm trusted publishing runtime and refresh prerelease tag#9

Merged
Ring-wdr merged 1 commit intomainfrom
fix/npm-trusted-publish-cli-version
Mar 25, 2026
Merged

Fix npm trusted publishing runtime and refresh prerelease tag#9
Ring-wdr merged 1 commit intomainfrom
fix/npm-trusted-publish-cli-version

Conversation

@Ring-wdr
Copy link
Owner

Summary

  • upgrade the npm publish workflow to a trusted-publishing compatible runtime
  • install the latest npm explicitly in the publish job and print runtime versions
  • bump the prerelease validation version to 0.1.35-rc.1

Validation

  • npm run build
  • npm test
  • README or docs updated when behavior changed

Maintainer Notes

  • The previous release v0.1.35-rc.0 failed because the publish job ran npm 10.9.4.
  • npm trusted publishing currently requires npm 11.5.1+; this PR updates the workflow accordingly.
  • After merge, validate again by creating GitHub Release v0.1.35-rc.1 from main.
  • Do not relax branch protection, required reviews, or required CI checks to merge this PR.

The publish workflow was running Node 22.22.1 with npm 10.9.4, which is below npm's current trusted publishing requirement. Upgrade the publish job to Node 24, install the latest npm explicitly, and bump the prerelease version to 0.1.35-rc.1 for a fresh release-path validation.

Constraint: Existing release tag v0.1.35-rc.0 cannot be reused after a failed publish attempt
Rejected: Keep Node 22 only | GitHub runner image currently bundles npm 10.9.4 in that lane
Rejected: Retry the same release again | reruns keep the old workflow definition and package version
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep runtime version output in the publish job until OIDC publishing is stable across releases
Tested: npm run build; npm test; npm pack --dry-run
Not-tested: End-to-end GitHub Release triggered npm publish via OIDC until merged and released from main
@Ring-wdr Ring-wdr merged commit 8cd472f into main Mar 25, 2026
4 checks passed
@Ring-wdr Ring-wdr deleted the fix/npm-trusted-publish-cli-version branch March 25, 2026 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant