Publish with NPM 11 (#47)

Author: johnhwhite

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "skyux-sdk-actions",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "GitHub actions for SKY UX libraries.",
   "main": "lib/main.js",
   "scripts": {

package.json

@@ -60,7 +60,7 @@ describe('npmPublish', () => {
       notifySlack: slackSpy,
     });
 
-    spawnSpy = jasmine.createSpy('spawn');
+    spawnSpy = jasmine.createSpy('spawn').and.returnValue(Promise.resolve(''));
 
     mock('./spawn', {
       spawn: spawnSpy,
@@ -113,7 +113,9 @@ describe('npmPublish', () => {
   it('should publish to NPM without npm-token', async () => {
     mockNpmToken = '';
 
-    const { npmPublish } = getUtil();
+    const { npmPublish, nodeVersionGetter } = getUtil();
+
+    spyOn(nodeVersionGetter, 'getVersion').and.returnValue('v24.0.0');
 
     await npmPublish();
 
@@ -216,4 +218,89 @@ describe('npmPublish', () => {
       'Aborted publishing to NPM because the version listed in package.json (1.0.0) does not match the git tag (1.1.0)!',
     );
   });
+
+  it('should use npm from Node.js 24 when current Node version is below 24 and no token is provided', async () => {
+    mockNpmToken = '';
+
+    const { npmPublish, nodeVersionGetter } = getUtil();
+
+    spyOn(nodeVersionGetter, 'getVersion').and.returnValue('v20.0.0');
+
+    spawnSpy.and.callFake((command: string, _args: string[]) => {
+      if (command === 'sh') {
+        return Promise.resolve('/mock/nvm/versions/node/v24.0.0/bin/npm');
+      }
+      return Promise.resolve();
+    });
+
+    await npmPublish();
+
+    expect(spawnSpy).toHaveBeenCalledWith('sh', [
+      '-c',
+      'ls $NVM_DIR/versions/node/v24.*/bin/npm',
+    ]);
+    expect(spawnSpy).toHaveBeenCalledWith(
+      '/mock/nvm/versions/node/v24.0.0/bin/npm',
+      ['publish', '--access', 'public', '--tag', 'latest'],
+      {
+        cwd: path.join(process.cwd(), 'MOCK_WORKING_DIRECTORY', 'dist'),
+        stdio: 'inherit',
+      },
+    );
+  });
+
+  it('should fail if Node.js 24 is not available when current Node version is below 24 and no token is provided', async () => {
+    mockNpmToken = '';
+
+    const { npmPublish, nodeVersionGetter } = getUtil();
+
+    spyOn(nodeVersionGetter, 'getVersion').and.returnValue('v20.0.0');
+
+    await expectAsync(npmPublish()).toBeRejectedWith(
+      'Aborted publishing to NPM with trusted publishing because NPM from Node.js 24 could not be found!',
+    );
+
+    expect(spawnSpy).toHaveBeenCalledWith('sh', [
+      '-c',
+      'ls $NVM_DIR/versions/node/v24.*/bin/npm',
+    ]);
+  });
+
+  it('should use regular npm when Node version is 24 or above and no token is provided', async () => {
+    mockNpmToken = '';
+
+    const { npmPublish, nodeVersionGetter } = getUtil();
+
+    spyOn(nodeVersionGetter, 'getVersion').and.returnValue('v24.0.0');
+
+    await npmPublish();
+
+    expect(spawnSpy).toHaveBeenCalledWith(
+      'npm',
+      ['publish', '--access', 'public', '--tag', 'latest'],
+      {
+        cwd: path.join(process.cwd(), 'MOCK_WORKING_DIRECTORY', 'dist'),
+        stdio: 'inherit',
+      },
+    );
+    expect(spawnSpy).not.toHaveBeenCalledWith('ls', jasmine.any(Array));
+  });
+
+  it('should use regular npm when token is provided regardless of Node version', async () => {
+    const { npmPublish, nodeVersionGetter } = getUtil();
+
+    spyOn(nodeVersionGetter, 'getVersion').and.returnValue('v20.0.0');
+
+    await npmPublish();
+
+    expect(spawnSpy).toHaveBeenCalledWith(
+      'npm',
+      ['publish', '--access', 'public', '--tag', 'latest'],
+      {
+        cwd: path.join(process.cwd(), 'MOCK_WORKING_DIRECTORY', 'dist'),
+        stdio: 'inherit',
+      },
+    );
+    expect(spawnSpy).not.toHaveBeenCalledWith('ls', jasmine.any(Array));
+  });
 });

src/utility/npm-publish.spec.ts

@@ -2,12 +2,19 @@ import * as core from '@actions/core';
 
 import * as fs from 'fs-extra';
 import * as path from 'path';
+import * as semver from 'semver';
 
 import { getTag } from './context';
 import { notifySlack } from './notify-slack';
 import { PackageMetadata } from './package-metadata';
 import { spawn } from './spawn';
 
+// Export for testing purposes
+/* istanbul ignore next */
+export const nodeVersionGetter = {
+  getVersion: () => process.version,
+};
+
 export async function npmPublish(distPath?: string): Promise<PackageMetadata> {
   distPath =
     distPath ||
@@ -37,12 +44,27 @@ export async function npmPublish(distPath?: string): Promise<PackageMetadata> {
     `Preparing to publish ${packageName}@${version} to NPM from ${distPath}...`,
   );
 
+  let npmCommand: string | undefined = 'npm';
   if (npmToken) {
     await fs.ensureFile(npmFilePath);
     fs.writeFileSync(
       npmFilePath,
       `//registry.npmjs.org/:_authToken=${npmToken}`,
     );
+  } else if (semver.lt(nodeVersionGetter.getVersion(), '24.0.0')) {
+    // Use npm from Node.js 24 if no token is provided to use NPM 11 and trusted publishing.
+    npmCommand = await spawn('sh', [
+      '-c',
+      'ls $NVM_DIR/versions/node/v24.*/bin/npm',
+    ]).then((result) => result?.trim().split('\n').shift());
+    if (!npmCommand) {
+      core.setFailed(
+        'Aborted publishing to NPM with trusted publishing because NPM from Node.js 24 could not be found!',
+      );
+      return Promise.reject(
+        'Aborted publishing to NPM with trusted publishing because NPM from Node.js 24 could not be found!',
+      );
+    }
   }
 
   const npmArgs = ['publish', '--access', 'public', '--tag', npmTag];
@@ -54,7 +76,7 @@ export async function npmPublish(distPath?: string): Promise<PackageMetadata> {
   }
 
   try {
-    await spawn('npm', npmArgs, {
+    await spawn(npmCommand, npmArgs, {
       cwd: distPath,
       stdio: 'inherit',
     });