fix(npm): bump Node to 24 so OIDC trusted publishing works#221
Merged
Conversation
Up to standards ✅🟢 Issues
|
There was a problem hiding this comment.
Pull request overview
Removes registry-url from the release workflow’s actions/setup-node@v4 step to prevent setup-node from writing an .npmrc that forces broken token auth, allowing npm to fall through to OIDC trusted publishing as intended.
Changes:
- Drop
registry-url: https://registry.npmjs.orgfrom the Node setup step sosetup-nodedoesn’t generate an auth-bearing.npmrcthat blocks OIDC publishing.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
npm 10.x (Node 22) ships an OIDC trusted-publishing implementation that signs provenance attestations but does not fall through to OIDC for the package PUT, resulting in 404s when no token auth is configured. npm 11.6+ (Node 24) handles the flow correctly. Reference: npm/cli#8730 (comment)
tkrugg
force-pushed
the
fix/npm-oidc-no-registry-url
branch
from
e39a5bb to
5a7e37e
Compare
tkrugg
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v1.10.3andv1.10.4releases failed at the npm publish step with:The provenance step succeeded (uses OIDC directly), but the package upload failed despite trusted publishers being configured for all 7 packages.
Root cause: npm 10.x (shipped with Node 22) has an incomplete OIDC trusted-publishing implementation — it can sign provenance attestations using the GitHub Actions OIDC token, but doesn't fall through to OIDC for authenticating the actual package PUT. npm 11.6+ (shipped with Node 24) handles the flow end-to-end.
Reference: npm/cli#8730 (comment) — Jason3S confirms Node 22 doesn't work, Node 24 with npm 11.6.2 does.
Change
Single-line bump:
node-version: "22"→"24".