scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-10-09 03:17:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

fix(ci): bump publish job to Node 24 for npm OIDC support (#1628)

Browse source 
PR #1627's npm install -g npm@latest step crashed mid-install with MODULE_NOT_FOUND: promise-retry — a known fragility when npm self-upgrades. Node 22's bundled npm is 10.9.x (no OIDC). Fix: bump publish job's node-version to 24, which ships with npm 11.x natively. Package consumers unaffected (this Node version is only used during publish; engines.node is >=22.0.0; ci-tests.yml continues testing on Node 22).
This commit is contained in:
Gergő Magyar 2026-05-16 09:18:08 +01:00 • committed by GitHub
parent f69c382bcb
commit f28185d67e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
.github/workflows/publish.yml vendored
View file

@ -371,7 +371,15 @@ jobs:
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 22
# Node 24 ships with npm >= 11.5.x, which is the minimum that
# supports npm Trusted Publishing OIDC. Node 22 ships with npm
# 10.9.x (no OIDC) and `npm install -g npm@latest` to self-upgrade
# is fragile — it can crash the in-flight reify with
# `MODULE_NOT_FOUND` on `promise-retry` etc. Bumping the Node
# version is the clean fix; the package's `engines` field is
# `>=22.0.0` so consumer-side compatibility is unaffected (this
# Node version is only used during publish, not by package users).
node-version: 24
# `registry-url:` is intentionally OMITTED. Under npm Trusted
# Publishing, OIDC only engages when no credential is configured.
# Setting `registry-url:` would make setup-node write
@ -388,18 +396,6 @@ jobs:
# cache-poisoning audit). ~30s slower per release; runs rarely.
package-manager-cache: false
# npm Trusted Publishing requires npm >= 11.5.1. The Node 22 runner
# currently ships with npm 10.9.x which has no OIDC support — without
# this upgrade, `npm publish` falls back to classic auth and the
# registry returns 404 because no token is configured. Upgrade
# globally so subsequent `npm` invocations in this job use the new
# binary.
- name: Upgrade npm for Trusted Publishing
shell: bash
run: |
npm install -g npm@latest
npm --version
- name: Build gitnexus-shared
run: npm install && npm run build
working-directory: gitnexus-shared