fix(release): allow npm registry lookups

[mattrothenberg]

Summary

• allow Changesets' npm registry lookup to run in the pnpm-managed workspace
• preserve Vite+'s devEngines.packageManager download behavior
• let the next release run publish the already-versioned, currently unpublished packages

Validation

• verified npm info fails with EBADDEVENGINES without the override
• verified NPM_CONFIG_FORCE=true npm info proceeds past the engine check
• pnpm vp fmt --check .github/workflows/release.yml
• git diff --check

No changeset is included intentionally: this workflow-only fix must retry the versions already committed by the Version Packages PR.

• Reviews
• automated review not possible because: this is a narrowly scoped release workflow environment fix
• Tests
• Automated tests not possible - manual testing has been completed as follows: reproduced the npm devEngines failure locally and verified the scoped force override proceeds past it

[pkg-pr-new]

npm i https://pkg.pr.new/@cloudflare/kumo@808

commit: fc69e8b

[mattrothenberg]

/bonk please review

[ask-bonk]

LGTM!

Review notes

• Confirmed the target is PR fix(release): allow npm registry lookups #808 and inspected its one-file release-workflow diff, full workflow context, existing reviews/comments, and package-manager configuration.
• Verified the pinned Changesets action inherits the step environment for its configured publish command. The release workflow formatting check could not run because pnpm is unavailable in this runner.
• git diff --check completed without whitespace errors, and the working tree remains clean. No actionable regression was identified.

github run

[ask-bonk]

LGTM!

Review notes

• Confirmed the review target is PR fix(release): allow npm registry lookups #808 (fix(release): allow npm registry lookups). I am inspecting the release workflow change, its surrounding execution context, and existing PR reviews.
• The checked-out workflow contains the three added NPM_CONFIG_FORCE lines scoped to the Changesets action. No .github-specific instructions exist. The local clone lacks origin/main, so I will obtain the PR patch and review history from GitHub rather than infer a base diff.
• Verified PR fix(release): allow npm registry lookups #808 is at the requested head SHA and has no prior reviews or inline findings. The patch is clean and changes only the release action environment; the workspace declares pnpm devEngines.packageManager with onFail: "download", while publishing remains vp run release followed by changeset publish.
• I am checking the pinned Changesets action's command execution and npm/pnpm configuration handling to verify the override reaches registry lookups without changing the publish path unexpectedly.
• The release workflow base and PR patch match the supplied change exactly. Repository checks already completed successfully include formatting, build, CodeQL, changeset validation, docs checks, and package preview; remaining PR checks are still running.
• Local package-manager configuration execution is unavailable because pnpm is not installed in this read-only runner. I am completing source-level validation of the pinned action and lockfile metadata instead.
• Verified the pinned Changesets action forwards the step environment to both configured version and publish commands, so the override is available to changeset publish and its npm registry queries. The release command itself remains unchanged, and no actionable regression was identified.

github run

[github-actions]

📐 Bundle Size

Consumer fixtures bundled against packages/kumo/dist (peers external, minified ESM).

Fixture	Raw	Gzip	Brotli
Button (root)	174.6 KB	49.9 KB	43.1 KB
Button (components/button)	174.5 KB	49.9 KB	43.1 KB
Button + Dialog + Select (root)	299.5 KB	85.8 KB	71.9 KB
Button + Dialog + Select (component subpaths)	299.5 KB	85.9 KB	71.9 KB
Chart (root)	247.0 KB	71.1 KB	60.9 KB
Chart (components/chart)	246.9 KB	71.1 KB	60.9 KB
Badge (components/badge)	44.7 KB	11.7 KB	10.0 KB
Flow (components/flow)	208.9 KB	58.3 KB	50.5 KB
Button (primitives/button)	12.2 KB	4.4 KB	3.9 KB
Primitives barrel	635.8 KB	176.9 KB	139.3 KB
Code highlighting (code)	2.08 MB	468.0 KB	349.3 KB

npm tarball: 544 files, 1.49 MB packed, 6.95 MB unpacked.

⚠️ 23 flagged files in tarball (tests / raw scripts)

• dist/blocks-source/resource-list/resource-list.test.tsx
• scripts/component-registry/cache.ts
• scripts/component-registry/discovery.ts
• scripts/component-registry/example-cleanup.ts
• scripts/component-registry/index.test.ts
• scripts/component-registry/index.ts
• scripts/component-registry/markdown-generator.ts
• scripts/component-registry/metadata.ts
• scripts/component-registry/props-filter.ts
• scripts/component-registry/schema-generator.ts
• scripts/component-registry/sub-components.ts
• scripts/component-registry/types.ts
• scripts/component-registry/utils.ts
• scripts/component-registry/variant-parser.ts
• scripts/css-build.ts
• scripts/generate-globe-land-mask.mjs
• scripts/generate-primitives.ts
• scripts/theme-generator/config.ts
• scripts/theme-generator/generate-css.test.ts
• scripts/theme-generator/generate-css.ts
• scripts/theme-generator/index.ts
• scripts/theme-generator/migrate.ts
• scripts/theme-generator/types.ts

Report-only: no size thresholds are enforced yet.

Commit: fc69e8b9

[github-actions]

Visual contracts

Linux Chromium references exercised by the PR's visual-contracts job.

1 curated contract

truncating text trigger

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview URL: https://fix-release-npm-dev-engines-kumo-docs.design-engineering.workers.dev (commit fc69e8b)

This URL reflects your latest Preview deployment

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ Deployment: Success ✅ View logs ↗	https://6712ab54-kumo-docs.design-engineering.workers.dev	fc69e8b	2026-09-17T16:31:36.820Z	Visit the dashboard ↗