From 23f71248653292a0f0d801c4758ac3d99783f5df Mon Sep 17 00:00:00 2001 From: NagyVikt Date: Fri, 12 Jun 2026 17:45:36 +0200 Subject: [PATCH] ci(release): npm >= 11.5.1 so OIDC trusted publishing can mint tokens MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit changesets/action detects OIDC (id-token: write is set) when NPM_TOKEN is absent, but Node 20 bundles npm 10.x which cannot do the OIDC exchange — publish died with ENEEDAUTH. Upgrading npm completes the runner side; the npmjs.com side needs colonyq to list opencue/colony + release.yml as a trusted publisher. --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2527660..24e92de 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,6 +26,12 @@ jobs: cache: 'pnpm' registry-url: 'https://registry.npmjs.org' + # npm OIDC trusted publishing needs npm >= 11.5.1; Node 20 bundles 10.x. + # With no NPM_TOKEN secret, changesets/action falls back to OIDC — which + # only works once the npm CLI can mint the id-token AND the colonyq + # package on npmjs.com lists this repo/workflow as a trusted publisher. + - run: npm install -g npm@^11.5.1 + - run: pnpm install --frozen-lockfile # Build first — every package's exports point to ./dist/, and the unit