From b3da0705074bd238dbd70d5f484c0076898f195f Mon Sep 17 00:00:00 2001
From: A Ibrahim <aibrahim@tigrisdata.com>
Date: Fri, 3 Jul 2026 08:43:41 +0200
Subject: [PATCH] ci: fix OIDC npm publish; run CI on PRs only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

release.yaml: install npm 11 (pinned to the major, latest 11.x) before
publishing in the release and beta jobs. Node 22 bundles npm ~10.9, which
signs provenance but cannot authenticate `npm publish` via OIDC trusted
publishing (added in npm 11.5.1) — the first changesets release failed
with E404. Old semantic-release worked because @semantic-release/npm did
its own OIDC token exchange.

ci.yaml: run on pull_request to main only (drop the push trigger and the
next branch); release.yaml now covers push-to-main integration.

Assisted-by: Claude Opus 4.8 via Claude Code
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yaml      |  8 ++------
 .github/workflows/release.yaml | 12 ++++++++++++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 82fb44d..ed831ec 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -2,10 +2,6 @@ name: CI
 
 on:
   pull_request:
-    branches:
-      - main
-      - next
-  push:
     branches:
       - main
   workflow_dispatch:
@@ -19,7 +15,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v5
         with:
-          node-version: '22'
+          node-version: "22"
       - run: npm ci
       - run: npm run test
       - run: npm run build
@@ -36,7 +32,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-node@v5
         with:
-          node-version: '22'
+          node-version: "22"
       - run: npm ci
       - run: npm run build
       - run: npm run test:integration
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 686413d..a7c9a65 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -35,6 +35,12 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
+      # OIDC trusted publishing on `npm publish` needs npm >= 11.5.1; node 22
+      # bundles npm ~10.9, which can sign provenance but cannot authenticate
+      # the publish via OIDC (semantic-release did its own OIDC exchange).
+      # Pin to major 11 (latest 11.x) rather than @latest for reproducibility.
+      - run: npm install -g npm@11
+
       - run: npm ci
       - run: npm run lint
       - run: npm run build
@@ -206,6 +212,12 @@ jobs:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
 
+      # OIDC trusted publishing on `npm publish` needs npm >= 11.5.1; node 22
+      # bundles npm ~10.9, which can sign provenance but cannot authenticate
+      # the publish via OIDC (semantic-release did its own OIDC exchange).
+      # Pin to major 11 (latest 11.x) rather than @latest for reproducibility.
+      - run: npm install -g npm@11
+
       - run: npm ci
       - run: npm run build