fix(ci): pin npm@11 in publish workflow, file issue on publish failure - #4265
Merged
Conversation
npm install -g npm@latest now installs npm 12, which requires node >= 22.22.2 while .nvmrc pins 22.16.0 (EBADENGINE) - this silently broke the v10.3.3 and v10.3.4 npm publishes. Pin npm@11 (supports node >=22.9.0, has OIDC since 11.5.1) and add a job that opens an issue when the publish job fails.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The v10.3.3 and v10.3.4 npm publishes both failed silently: the "Upgrade npm for OIDC support" step runs
npm install -g npm@latest, and npm 12 now requires node >= 22.22.2 while.nvmrcpins 22.16.0, so the step fails withEBADENGINE(see v10.3.4 run, v10.3.3 run). npm'slatestdist-tag is still 10.3.2.This pins
npm@11(supports node >= 22.9.0 and has the OIDC/provenance support since 11.5.1), and adds anotify-failurejob that opens a GitHub issue whenever the publish job fails, so a broken release no longer goes unnoticed.Note: re-running the failed runs won't help since release-triggered workflows use the workflow file from the tagged commit; v10.3.3/v10.3.4 need to be re-released from a commit containing this fix (or superseded by a 10.3.5).
Checklist
CONTRIBUTING.mdyarn generatein the root folder/exampleapp./example)CI-only change; example app checklist items are not applicable.