From 4cd0e1488d84a003d6997c441650cffdddf95a55 Mon Sep 17 00:00:00 2001
From: Sutu Sebastian <sebiitv@gmail.com>
Date: Mon, 6 Jul 2026 14:38:59 +0300
Subject: [PATCH] docs(lessons): append two release-infra gotchas from the
 0.2.0 publish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- npm trusted publishing (OIDC) needs npm ≥ 11.5.1 + Node ≥ 22.14;
  setup-bun leaves npm 10.x in PATH → must also actions/setup-node.
- Don't pin a GitHub action to a moving major tag's commit SHA — the tag
  moves + orphans the commit; pin to an immutable release-tag commit or
  use the moving @vN tag.

Both hit the 0.2.0 release (ENEEDAUTH, then "unable to find version").
Durable, non-obvious, not in any rule/skill yet.
---
 .agents/lessons.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.agents/lessons.md b/.agents/lessons.md
index 0ddf585..e12025c 100644
--- a/.agents/lessons.md
+++ b/.agents/lessons.md
@@ -16,3 +16,6 @@ alwaysApply: true
 
 <!-- Append durable corrections below, one bullet per line. Keep this file
      short — lift into rules/skills when a lesson becomes policy. -->
+
+- npm trusted publishing (OIDC) needs npm ≥ 11.5.1 + Node ≥ 22.14; oven-sh/setup-bun leaves npm 10.x in PATH, so a release job running `changeset publish`/`npm publish` must also run actions/setup-node (Node 24 → npm 11) or OIDC isn't detected → ENEEDAUTH.
+- Don't pin a GitHub action to a moving major tag's commit SHA (e.g. setup-node@<v6-tag-commit>) — the tag moves and orphans/GCs the commit → "unable to find version"; pin to an immutable release-tag commit or use the moving @vN tag.