From 66154e54b34f4ab7e9620031e75036f23badb0cd Mon Sep 17 00:00:00 2001 From: Rodri Date: Sat, 18 Jul 2026 12:15:32 +0100 Subject: [PATCH 1/3] Migrate npm publishing to Trusted Publishing (OIDC) --- .github/workflows/release.yml | 8 +++++--- .gitignore | 4 +++- .nvmrc | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 392e507..de40a66 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -16,11 +16,14 @@ jobs: contents: write # to create release (changesets/action) issues: write # to post issue comments (changesets/action) pull-requests: write # to create pull request (changesets/action) + id-token: write # to authenticate to npm via OIDC trusted publishing steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 with: node-version-file: '.nvmrc' + # Trusted publishing requires npm >= 11.5.1 + - run: npm install -g npm@latest && npm -v - run: yarn install --frozen-lockfile - id: changesets uses: changesets/action@v1 @@ -28,4 +31,3 @@ jobs: publish: yarn release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - NPM_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/.gitignore b/.gitignore index bfd8663..07a7b38 100644 --- a/.gitignore +++ b/.gitignore @@ -29,4 +29,6 @@ build .vscode -coverage \ No newline at end of file +coverage + +.claude \ No newline at end of file diff --git a/.nvmrc b/.nvmrc index 2dbbe00..7377d13 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -20.11.1 +22.17.1 From a135757f7c26e7f0a19e37a8299ff384add475a4 Mon Sep 17 00:00:00 2001 From: Rodri Date: Sat, 18 Jul 2026 12:36:40 +0100 Subject: [PATCH 2/3] Pin npm upgrade to v11 in release workflow npm@latest is now npm 12, which requires Node >= 22.22.2 and fails EBADENGINE on the Node 22.17.1 pinned in .nvmrc. npm 11 supports trusted publishing (>= 11.5.1) and runs on Node ^20.17.0 || >=22.9.0. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index de40a66..a5d6851 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,8 +22,8 @@ jobs: - uses: actions/setup-node@v4 with: node-version-file: '.nvmrc' - # Trusted publishing requires npm >= 11.5.1 - - run: npm install -g npm@latest && npm -v + # Trusted publishing requires npm >= 11.5.1 (npm@12 needs a newer node than .nvmrc pins) + - run: npm install -g npm@11 && npm -v - run: yarn install --frozen-lockfile - id: changesets uses: changesets/action@v1 From 3a860ce744df76421de68460edd0bd3f7804e2d0 Mon Sep 17 00:00:00 2001 From: Rodri Date: Sat, 18 Jul 2026 12:39:21 +0100 Subject: [PATCH 3/3] Use Node 24 LTS instead of upgrading npm in CI Node 24.18.0 bundles npm >= 11.5.1, which is all trusted publishing needs, so drop the global npm upgrade step from the release workflow. Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 2 -- .nvmrc | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a5d6851..1b9174b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,8 +22,6 @@ jobs: - uses: actions/setup-node@v4 with: node-version-file: '.nvmrc' - # Trusted publishing requires npm >= 11.5.1 (npm@12 needs a newer node than .nvmrc pins) - - run: npm install -g npm@11 && npm -v - run: yarn install --frozen-lockfile - id: changesets uses: changesets/action@v1 diff --git a/.nvmrc b/.nvmrc index 7377d13..ca5c350 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -22.17.1 +24.18.0