ci: publish on Node 24 with a pinned npm - #101
Merged
Merged
Conversation
The publish workflow ran on Node 25 and then did
`npm install -g npm@latest`. npm 12 requires
`^22.22.2 || ^24.15.0 || >=26.0.0`, which excludes Node 25, so that
step died with EBADENGINE as soon as npm 12 shipped and the package
could no longer publish:
npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual: {"node":"v25.9.0","npm":"11.12.1"}
Move to Node 24 — an LTS line every npm 11.x and 12.x supports — and
pin the upgrade to `npm@^11.5.1` (the floor OIDC trusted publishing
needs) rather than `@latest`, so the next npm major dropping this Node
line cannot silently break publishing fleet-wide again.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw
|
ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing |
PR Summary by QodoFix npm publishing with Node 24 and pinned npm 11
AI Description
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
1. Publishing can break unnoticed again
|
![qodo-free-for-open-source-projects[bot]](https://avatars.githubusercontent.com/in/1068000?s=60&v=4){kind=small}
| # this Node line would silently break publishing fleet-wide again. | ||
| - name: Upgrade npm to >=11.5.1 (required for trusted publishing) | ||
| run: npm install -g npm@latest | ||
| run: npm install -g npm@^11.5.1 |
There was a problem hiding this comment.
1. Publishing can break unnoticed again 📘 Rule violation ▣ Testability
.github/workflows/npmpublish.yml changes the runtime to Node 24 and replaces npm@latest with npm@^11.5.1, but this bug-fix changeset adds or modifies no automated test. A later edit that restores an incompatible Node and npm pairing will not be caught before the publish workflow runs and can again prevent every plugin from publishing.
Agent Prompt
## Issue description
The publish workflow fixes an incompatible Node and npm combination without adding an automated regression test that fails against the prior configuration.
## Fix Focus Areas
- .github/workflows/npmpublish.yml[28-33]
## Recommended Fix
Add an automated test in this changeset that parses or validates the publish workflow and rejects incompatible Node and npm combinations. Ensure it fails for Node 25 with `npm@latest`, passes for Node 24 with the bounded npm 11 range, and runs in the repository's normal continuous-integration checks.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
.github/workflows/npmpublish.ymlran the publish job on Node 25 and thenupgraded npm with
npm install -g npm@latest. npm 12 requires^22.22.2 || ^24.15.0 || >=26.0.0— Node 25 is not in that range — so as soonas npm 12 shipped, that step started dying:
Every plugin's publish has been failing since.
The fix
node-version: 25→node-version: 24— an LTS line that every npm 11.xand 12.x supports.
npm@latest→npm@^11.5.1— 11.5.1 is the floor OIDC trusted publishingneeds. Pinning to a range rather than
@latestmeans the next npm majordropping this Node line cannot silently break publishing fleet-wide again.
No other change. Mirrors the merged pilot, ether/ep_align#227.
🤖 Generated with Claude Code
https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw