fix(publish-npm): keep npm upgrade compatible with Node 20

[Ryan Zhu (underthestars-zhy)]

Summary

• pin the publish action's npm upgrade to the npm 11 release line
• document why npm 12 cannot be installed on the action's default Node 20 runtime
• retain npm OIDC Trusted Publishing support, which requires npm 11.5.1 or newer

Verification

• confirmed the current npm 11 release supports Node ^20.17.0 || >=22.9.0
• validated the composite action YAML
• verified the branch diff has no whitespace errors

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: afc232e7-b96e-4d8e-81df-7e0ff7180206

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/pin-node20-compatible-npm-edbf

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📄 README may need an update

This PR introduces changes that might not be reflected in README.md.

Reason: README.md’s publish-npm documentation is missing the public publish-command input now supported by .github/blocks/publish-npm/action.yaml, so it no longer fully reflects the action’s current configurable API.

This is an automated check powered by AI. If the README is intentionally unchanged, feel free to ignore this.

[github-actions]

📚 Skills documentation may need an update

This PR introduces changes that might not be reflected in the skills documentation.

Reason: _skills-repo/skills/buildspace-ci-cd/SKILL.md is now outdated because publish-npm and typescript-service-release support npm OIDC Trusted Publishing with id-token: write and NPM_TOKEN as fallback, but the skill still documents token-only publishing and omits the new permission/setup behavior.

This is an automated check powered by AI. If the skills are intentionally unchanged, feel free to ignore this.