From f28185d67eb212a404efeed884737566ee64bc5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gerg=C5=91=20Magyar?= <gergomagyar@icloud.com>
Date: Sat, 16 May 2026 09:18:08 +0100
Subject: [PATCH] fix(ci): bump publish job to Node 24 for npm OIDC support
 (#1628)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #1627's npm install -g npm@latest step crashed mid-install with MODULE_NOT_FOUND: promise-retry — a known fragility when npm self-upgrades. Node 22's bundled npm is 10.9.x (no OIDC). Fix: bump publish job's node-version to 24, which ships with npm 11.x natively. Package consumers unaffected (this Node version is only used during publish; engines.node is >=22.0.0; ci-tests.yml continues testing on Node 22).
---
 .github/workflows/publish.yml | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b62c39406..122130310 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -371,7 +371,15 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          # Node 24 ships with npm >= 11.5.x, which is the minimum that
+          # supports npm Trusted Publishing OIDC. Node 22 ships with npm
+          # 10.9.x (no OIDC) and `npm install -g npm@latest` to self-upgrade
+          # is fragile — it can crash the in-flight reify with
+          # `MODULE_NOT_FOUND` on `promise-retry` etc. Bumping the Node
+          # version is the clean fix; the package's `engines` field is
+          # `>=22.0.0` so consumer-side compatibility is unaffected (this
+          # Node version is only used during publish, not by package users).
+          node-version: 24
           # `registry-url:` is intentionally OMITTED. Under npm Trusted
           # Publishing, OIDC only engages when no credential is configured.
           # Setting `registry-url:` would make setup-node write
@@ -388,18 +396,6 @@ jobs:
           # cache-poisoning audit). ~30s slower per release; runs rarely.
           package-manager-cache: false
 
-      # npm Trusted Publishing requires npm >= 11.5.1. The Node 22 runner
-      # currently ships with npm 10.9.x which has no OIDC support — without
-      # this upgrade, `npm publish` falls back to classic auth and the
-      # registry returns 404 because no token is configured. Upgrade
-      # globally so subsequent `npm` invocations in this job use the new
-      # binary.
-      - name: Upgrade npm for Trusted Publishing
-        shell: bash
-        run: |
-          npm install -g npm@latest
-          npm --version
-
       - name: Build gitnexus-shared
         run: npm install && npm run build
         working-directory: gitnexus-shared