From 5873c748cb4d5d5475ce99e985aefca7234cefe6 Mon Sep 17 00:00:00 2001 From: Yan Xue Date: Thu, 21 May 2026 22:56:58 -0700 Subject: [PATCH] ci(publish-npm): upgrade npm so OIDC Trusted Publishing works npm OIDC Trusted Publishing requires npm >= 11.5.1, but the publish job runs on Node 20 which bundles npm 10.x. On npm 10 the OIDC publish step signs provenance but cannot authenticate tokenlessly, so it falls through to an unauthenticated publish and fails with E404 ("not in this registry"). Install npm@latest after setup-node, before the publish steps, so the OIDC path can actually authenticate. Co-Authored-By: Claude Opus 4.7 --- .github/blocks/publish-npm/action.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/blocks/publish-npm/action.yaml b/.github/blocks/publish-npm/action.yaml index 84fca25..2cb4352 100644 --- a/.github/blocks/publish-npm/action.yaml +++ b/.github/blocks/publish-npm/action.yaml @@ -46,6 +46,15 @@ runs: node-version: ${{ inputs.node-version }} registry-url: 'https://registry.npmjs.org' + # npm OIDC Trusted Publishing requires npm >= 11.5.1, but Node 20 ships + # npm 10.x. Without this, the OIDC publish below signs provenance yet can't + # authenticate tokenlessly, so it publishes unauthenticated and 404s. + - name: Upgrade npm for OIDC Trusted Publishing + shell: bash + run: | + npm install -g npm@latest + echo "npm version: $(npm --version)" + - name: Install dependencies shell: bash working-directory: ${{ inputs.working-directory }}