ci: pin npm@11.18.0 to fix sigstore error on publish#70
Conversation
npm@latest now resolves to npm@12, whose bundled publish path fails with 'Cannot find module sigstore' when using --provenance. Pin to npm@11.18.0, which supports OIDC trusted publishing (>=11.5.1) without the npm 12 bug.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 7 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
Fixes the
publishjob that still fails after #69 (CI run 29033211302).With Node 22 in place,
npm install -g npm@latestnow resolves to npm@12, whose bundled publish path throwsCannot find module 'sigstore'when publishing with--provenance:This is a packaging bug in npm 12's bundled deps. Trusted publishing (OIDC) only needs npm >=11.5.1, so
@latestovershoots into a broken major.Change
Pin the publish step to npm@11.18.0 (latest 11.x) instead of
@latest. It supports OIDC trusted publishing and the--provenanceflow without the npm 12 sigstore regression.Impact
Once merged, the idempotent publish job will finally push the versions stuck since #68:
@arvoretech/hub-core0.26.2@arvoretech/hub(cli) 0.25.2@arvoretech/hub-pi1.5.3Notes
sigstoreerror (arvore-pi-extensions) confirms npm 12 is the culprit; the original intent was npm 11.5.1+.@latest) also prevents future@latestmajors from silently breaking publish again.