From e253d987814fed9d52fc67bcb579f346e2d650b5 Mon Sep 17 00:00:00 2001 From: Liran Cohen Date: Wed, 4 Mar 2026 20:29:51 +0000 Subject: [PATCH] fix: use Node 24 and remove registry-url for npm OIDC publishing Node 22 ships npm 10.x which does not support OIDC trusted publishing (requires npm 11.5.1+). Node 24 ships npm 11+. The registry-url param in setup-node creates an .npmrc with //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}. Since no NODE_AUTH_TOKEN is set (we removed it in #174), npm uses an empty token instead of auto-detecting the OIDC environment. Removing registry-url lets npm default to registry.npmjs.org and perform OIDC token exchange correctly. --- .github/workflows/npm-release.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml index b85fb9f..d76ec84 100644 --- a/.github/workflows/npm-release.yml +++ b/.github/workflows/npm-release.yml @@ -33,8 +33,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '22' - registry-url: 'https://registry.npmjs.org' + node-version: '24' - name: Install dependencies run: bun install --frozen-lockfile