From 3807e34a18b5ebf39917d7c7e9834dc315c7c460 Mon Sep 17 00:00:00 2001 From: Marko Vejnovic Date: Wed, 10 Jun 2026 15:34:04 -0700 Subject: [PATCH] fix(release): upgrade npm so OIDC trusted publishing authenticates node 20 ships npm 10, which signs provenance but can't authenticate a publish via OIDC trusted publishing (needs npm >= 11.5.1). The unauthenticated PUT was masked as a 404. Add 'npm install -g npm@latest' to the npm job. --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 67930950..aaac3470 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -198,6 +198,13 @@ jobs: cache: npm cache-dependency-path: crates/hm-dsl-engine/harmont-ts/package-lock.json + # node 20 ships npm 10, which can sign provenance but cannot AUTHENTICATE + # via OIDC trusted publishing — that needs npm >= 11.5.1. Without it the + # publish PUT goes out unauthenticated and npm masks it as a 404. Upgrade + # so the configured trusted publisher actually authenticates the publish. + - name: Upgrade npm for OIDC trusted publishing + run: npm install -g npm@latest + - name: Install dependencies working-directory: crates/hm-dsl-engine/harmont-ts run: npm ci