Skip to content

Conversation

@JoeCap08055
Copy link
Collaborator

Goal

The goal of this PR is to ensure that our CI pipeline is using at least version >= 11.5.1 of npm in order to support OID auth from GitHub.

It refactors many individual references to actions/setup-node into a composite action that incorporates both actions/setup-node as well as the specific commands to ensure a recent enough version of npm.

Another benefit is that the default version of Node.js for all of our CI workflows is now specified in a single place (but can stlll be overridden per invocation if necessary)

@JoeCap08055 JoeCap08055 requested a review from demisx as a code owner December 10, 2025 16:58
@JoeCap08055 JoeCap08055 requested review from a team, aramikm, enddynayn, sbendar and shannonwells and removed request for a team December 10, 2025 16:58
- name: Set up NodeJs
uses: actions/setup-node@v6
- name: Setup Node and npm
uses: ./.github/workflows/common/setup-node-and-npm
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm seeing the use NODE_AUTH_TOKEN and want to make sure that is different from what Scott mentioned for

And remove any reference to npm config that uses NPM_AUTH_TOKEN.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's only referenced in the description for the registry-url input of the new custom action. That description was copied from actions/setup-node@v6 because it's just a pass-through. I don't believe we're setting NPM_AUTH_TOKEN anywhere in our CI in this repo anymore. Unless it's configured at the organization level, but that's outside the scope of this PR.

I think registry-url is still relevant to use...

node-version:
description: 'Version Spec of the version to use. Examples: 12.x, 10.15.1, >=10.15.0.'
required: false
default: '22.x'
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

non-blocking: Is 22 the one we still want or should we go up to 24.x?

Copy link
Collaborator

@shannonwells shannonwells left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just the one question but I think this is fine assuming Aramik's Q about NODE_AUTH_TOKEN is resolved.

Copy link
Collaborator

@enddynayn enddynayn left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 great!

@JoeCap08055 JoeCap08055 merged commit 01936d7 into main Dec 10, 2025
33 checks passed
@JoeCap08055 JoeCap08055 deleted the feat/npm-oid-auth branch December 10, 2025 21:07
shannonwells added a commit to ProjectLibertyLabs/siwf that referenced this pull request Dec 11, 2025
We need to use npm v11.x, but we need to stick with earlier versions of
node, which have 10.x.  Pull in a version of the solution used with this [frequency-chain
PR](frequency-chain/frequency#2652)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants