fix(ci): install an npm new enough for trusted publishing

[vilenarios]

The 1.0.2 release now gets all the way to the publish and fails there:

npm notice version: 1.0.2
npm error code ENEEDAUTH
npm error need auth This command requires you to be logged in to https://registry.npmjs.org/

Cause

@semantic-release/npm does not publish with the OIDC token itself — it only confirms the exchange is possible, then deliberately writes no auth to .npmrc and lets npm publish handle it:

if (await oidcContextEstablished(registry, pkg, context)) return
await setNpmrcAuth(npmrc, registry, context)

npm gained trusted-publishing support in 11.5.1. The runner resolves node-version: 22 to 22.23.2, which bundles npm 10.x — so npm publish runs with no credentials at all.

Fix

Install npm ^11.5.1 before the release step, and print the version so this is visible in the log.

Note

The trusted publisher on npmjs.com is already correct. The registry only mints an exchange token for a matching repo + workflow, and the log shows:

OIDC token exchange with the npm registry succeeded

So this is the last piece — no npmjs.com change needed.

Related: the stale fix/release-disable-oidc branch (off the 1.0.1 release commit) hit this same wall and worked around it by abandoning OIDC. This fixes it instead, keeping trusted publishing and the provenance attestation that comes with it. That branch can be deleted.

[github-actions]

🎉 This PR is included in version 1.0.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀