fix(ci): upgrade npm in release workflows (trusted publishing needs >= 11.5.1)#51
Conversation
Node 22 bundles npm 10.x, which signs provenance but cannot perform the trusted-publishing token exchange — every CI publish has failed with npm's E404-on-PUT (force-release.yml has never had a successful run; 0.0.3 was evidently published manually). Add 'npm install -g npm@latest' to both release workflows before publishing. Note: npmjs.com-side trusted-publisher config (package Settings → Publishing access → GitHub Actions: taskade/mcp + workflow file) must also exist for both packages — that part is a web-UI action for a package owner.
|
There was a problem hiding this comment.
Pull request overview
Updates the GitHub Actions release workflows to ensure npm is new enough to support npm OIDC trusted publishing (token exchange), addressing publish failures that occur after provenance signing.
Changes:
- Add a step in
release.ymlto upgrade npm before installing dependencies and publishing. - Add the same npm-upgrade step in
force-release.ymlto keep the manual release path consistent.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/release.yml | Adds an npm upgrade step to meet trusted publishing’s minimum npm version requirement before running the Changesets publish flow. |
| .github/workflows/force-release.yml | Adds the same npm upgrade step for the workflow_dispatch “force release” publish path. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Upgrade npm for trusted publishing | ||
| run: npm install -g npm@latest && npm --version | ||
|
|
| - name: Upgrade npm for trusted publishing | ||
| run: npm install -g npm@latest && npm --version | ||
|
|
Diagnosis (from release run 27230619415 + force-release 27230718079)
Both publish paths fail with
npm error 404 Not Found - PUTafter provenance signing succeeds — npm's symptom for an unauthenticated publish. Two stacked causes:npm install -g npm@latestin both workflows).@taskade/mcp-server/@taskade/mcp-openapi-codegen→ requires a package owner in the npm web UI (Settings → Publishing access → add GitHub Actions publisher: orgtaskade, repomcp, workflowrelease.yml).Evidence that CI publishing never worked: every force-release.yml run in history is a failure (incl. May 19) —
0.0.3appears to have been published manually.Zero-regression
0.0.4automatically;force-releasestays as manual fallback.