fix(release): sudo npm install -g for Trusted Publishing upgrade

[amondnet]

Problem

The v0.1.3 run made it almost all the way: all 6 targets built, upload-release-assets ✅ (the GH_REPO fix worked), and update-homebrew-formula ✅. Only publish-npm failed — at its very first step:

$ npm install -g npm@latest
npm error code EACCES
npm error path /usr/local/share/man/man7
npm error Error: EACCES: permission denied, mkdir '/usr/local/share/man/man7'

The global npm prefix (/usr/local) is root-owned on GitHub's ubuntu runners, so installing a new global npm needs sudo. Without the upgrade, npm stays at 10.x and Trusted Publishing (requires npm ≥ 11.5.1) can't authenticate via OIDC.

This was the next latent failure, exposed only now that upload + Homebrew finally run end-to-end (the whole publish-npm job had never executed past this step before).

Fix

sudo npm install -g npm@latest.

The rest of publish-npm was reviewed and looks correct: gh release download already passes --repo, the generator runs against the downloaded assets, and the OIDC publish (no token, id-token: write, trusted publisher configured + verified on all 7 packages) needs only the upgraded npm.

Recovery

v0.1.3 failed before any npm publish, so nothing was half-published. Merging this fix: cuts 0.1.4, which should finally publish all 7 packages to npm via OIDC. v0.1.3's empty-on-npm tag will be cleaned up with the others.

Test plan

• YAML validated
• upload + Homebrew already proven green on v0.1.3
• 0.1.4 publishes 7 packages to npm via Trusted Publishing

---

Summary by cubic

Use sudo to upgrade global npm in the release workflow to meet Trusted Publishing’s >=11.5.1 requirement and avoid EACCES on GitHub runners.

• Bug Fixes
  • Update .github/workflows/release-please.yml to run sudo npm install -g npm@latest before publish-npm.
  • Unblocks OIDC-based publish by ensuring the correct npm version.

^{Written for commit 1627548. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Updated CI/CD pipeline configuration for improved npm installation handling in the release workflow.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 78b84e5f-59ba-47b2-bb6b-0cfa56345145

📥 Commits

Reviewing files that changed from the base of the PR and between a37d671 and 1627548.

📒 Files selected for processing (1)

• .github/workflows/release-please.yml

---

📝 Walkthrough

Walkthrough

In the publish-npm job of .github/workflows/release-please.yml, the npm upgrade step is changed to prefix npm install -g npm@latest with sudo, and the associated inline comments are updated to reflect this.

Changes

CI Workflow: npm Upgrade with sudo

Layer / File(s)	Summary
Add sudo to global npm install .github/workflows/release-please.yml	The "Upgrade npm for Trusted Publishing" step now runs sudo npm install -g npm@latest instead of without elevated privileges; inline comments are updated accordingly.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A bunny once tripped on a permission denied,
So sudo was added and npm complied.
With elevated rights the install ran clean,
The smoothest of upgrades this rabbit has seen!
🐇✨ sudo saves the day!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding sudo to the npm install command for Trusted Publishing upgrade in the release workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-upgrade-sudo

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}