From 60d1ca1ad481778e88f56e04345ee5414e16d0fa Mon Sep 17 00:00:00 2001 From: Jake Strawn Date: Tue, 19 May 2026 23:17:29 -0400 Subject: [PATCH] fix(publish): pin npm to 11.5.1 in publish job for OIDC trusted publishing --- .github/workflows/publish.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 8a69193..ecdf61e 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -32,6 +32,16 @@ jobs: registry-url: 'https://registry.npmjs.org' cache: 'pnpm' + - name: Install npm 11.5.1+ for OIDC trusted publishing + # pnpm publish shells out to the npm CLI for the registry PUT. + # Node 22's bundled npm (10.9.7) cannot perform OIDC trusted + # publishing and fails with a misleading "E404 not in this + # registry". Pin npm to 11.5.1 (first version with working TP-OIDC). + # --force gets past Node 22's bundled-npm arborist on the upgrade. + run: | + npm install -g npm@11.5.1 --force + npm --version + - name: Install dependencies run: pnpm install --frozen-lockfile