From eccdfe99920a017a3a85ad1c6c6038d0f37a9f03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mikl=C3=B3s=20Fazekas?= <mfazekas@szemafor.com>
Date: Wed, 22 Jul 2026 17:40:40 +0200
Subject: [PATCH] fix(ci): pin npm@11 in publish workflow, file issue on
 publish failure

npm install -g npm@latest now installs npm 12, which requires node >= 22.22.2
while .nvmrc pins 22.16.0 (EBADENGINE) - this silently broke the v10.3.3 and
v10.3.4 npm publishes. Pin npm@11 (supports node >=22.9.0, has OIDC since
11.5.1) and add a job that opens an issue when the publish job fails.
---
 .github/workflows/publish.yml | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 55e73466e4..4c8888ba22 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,8 +23,23 @@ jobs:
           node-version: ${{ steps.nvm.outputs.NVMRC }}
           registry-url: 'https://registry.npmjs.org'
       - name: Upgrade npm for OIDC support
-        run: npm install -g npm@latest
+        # npm 12 requires node >= 22.22.2, newer than our .nvmrc; npm 11.5.1+ has OIDC support
+        run: npm install -g npm@11
       - name: Install dependencies and build 🔧
         run: yarn install --immutable
       - name: Publish package on NPM 📦
         run: npm publish --provenance --access public ${{ github.event.release.prerelease && '--tag next' || ''}}
+  notify-failure:
+    runs-on: ubuntu-latest
+    needs: build
+    if: failure()
+    permissions:
+      issues: write
+    steps:
+      - name: Create issue about publish failure
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh issue create --repo "$GITHUB_REPOSITORY" \
+            --title "npm publish failed for ${{ github.event.release.tag_name }}" \
+            --body "The [Publish to NPM run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for release \`${{ github.event.release.tag_name }}\` failed. The package was not published to npm."