From 689ca635d5834f1c1b9c85cb2a005f2313973441 Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Mon, 5 Oct 2026 12:29:00 +0000 Subject: [PATCH 1/3] fix(publish-npm)!: stop installing npm at runtime and default to node 24 The workflow upgraded npm with an unpinned `npm install -g npm@11` when the bundled npm was too old for OIDC trusted publishing. Node.js >= 24.5.0 ships npm >= 11.5.1, so the workflow now defaults to node 24 and fails early with an explicit message instead of installing npm. The semver check is also pinned to semver@7.8.5, which has no dependencies. BREAKING CHANGE: the default node-version is now 24 instead of 20. Callers using OIDC trusted publishing must use Node.js >= 24.5.0: npm is no longer upgraded automatically. --- .github/workflows/publish-npm.yml | 8 ++++---- publish-npm/README.md | 8 ++++---- publish-npm/workflow-sha256 | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index a1e8186..ef74432 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -9,7 +9,7 @@ on: type: string node-version: description: "Node.js version to use" - default: "20" + default: "24" type: string registry: description: "NPM registry URL" @@ -121,11 +121,11 @@ jobs: run: | if [ -n "${{ secrets.npm-token }}" ]; then echo "npm-token secret is set not using OIDC" - elif [ -n "$(npx semver -r ">=11.5.1" "$(npm -v)")" ]; then + elif [ -n "$(npx semver@7.8.5 -r ">=11.5.1" "$(npm -v)")" ]; then echo "OIDC trusted publishing supported by current npm version" else - echo "OIDC trusted publishing requires npm >= 11.5.1, updating npm" - npm install -g npm@11 + echo "OIDC trusted publishing requires npm >= 11.5.1 (Node.js >= 24.5.0), current npm is $(npm -v)" + exit 1 fi - name: Install dependencies diff --git a/publish-npm/README.md b/publish-npm/README.md index 07c5c52..afd1df8 100644 --- a/publish-npm/README.md +++ b/publish-npm/README.md @@ -21,7 +21,7 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM | **Input** | **Description** | **Required** | **Default** | | --- | --- | --- | --- | | **scope** | NPM package scope (e.g., `@iexec`). | No | `@iexec` | -| **node-version** | Node.js version to use. | No | `20` | +| **node-version** | Node.js version to use. | No | `24` | | **registry** | NPM registry URL. | No | `https://registry.npmjs.org` | | **access** | Package access (public or restricted). | No | `public` | | **provenance** | Enable npm provenance. | No | `true` | @@ -61,7 +61,7 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM ### With Trusted Publishers (preferred) -> ⚠️ this method uses npm >= 11.5.1 ensure your project supports a compatible version of npm if not please use the method with npm token. +> ⚠️ this method requires npm >= 11.5.1, shipped with Node.js >= 24.5.0. Use a compatible `node-version`, or use the method with npm token. 1. **Call the Reusable Workflow** @@ -82,7 +82,7 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM publish: uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@main with: - node-version: "22" + node-version: "24" build-command: "npm run build:prod" run-tests: true test-command: "npm run test:ci" @@ -116,7 +116,7 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM publish: uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/publish-npm.yml@main with: - node-version: "22" + node-version: "24" build-command: "npm run build:prod" run-tests: true test-command: "npm run test:ci" diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256 index c9941ca..5a80462 100644 --- a/publish-npm/workflow-sha256 +++ b/publish-npm/workflow-sha256 @@ -1 +1 @@ -a936ca8dedd03c393e20d2716282cf3bc72bdc3bcfceae0d083686f938e6e513 +c798fb6e6263acab6f231c88e5250f869d8a73ac2bb0811e19b69877272014d5 From 4e47f17f5d577c439c6776686460232f6af96334 Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Tue, 6 Oct 2026 12:43:20 +0000 Subject: [PATCH 2/3] fix(publish-npm): clarify error when npm is too old for OIDC publishing The error now matches the README warning: it shows the current npm and Node.js versions, says how to fix it (use a compatible `node-version` or provide the `npm-token` secret), and appears as an error annotation on the workflow run. --- .github/workflows/publish-npm.yml | 2 +- publish-npm/workflow-sha256 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index ef74432..4f21c5f 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -124,7 +124,7 @@ jobs: elif [ -n "$(npx semver@7.8.5 -r ">=11.5.1" "$(npm -v)")" ]; then echo "OIDC trusted publishing supported by current npm version" else - echo "OIDC trusted publishing requires npm >= 11.5.1 (Node.js >= 24.5.0), current npm is $(npm -v)" + echo "::error::OIDC trusted publishing requires npm >= 11.5.1, shipped with Node.js >= 24.5.0 (current: npm $(npm -v), Node.js $(node -v)). Use a compatible \`node-version\` input, or provide the \`npm-token\` secret." exit 1 fi diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256 index 5a80462..446583c 100644 --- a/publish-npm/workflow-sha256 +++ b/publish-npm/workflow-sha256 @@ -1 +1 @@ -c798fb6e6263acab6f231c88e5250f869d8a73ac2bb0811e19b69877272014d5 +243c60661de8b313ccfca192af41b147c3ba94b36318ac3a5dcd901c6e9fa919 From b6c9bfc16a590bf065236a27292c2cb68cc8460e Mon Sep 17 00:00:00 2001 From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com> Date: Tue, 6 Oct 2026 15:18:03 +0200 Subject: [PATCH 3/3] docs: reference npm-token with input name --- publish-npm/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/publish-npm/README.md b/publish-npm/README.md index afd1df8..4c0f7d4 100644 --- a/publish-npm/README.md +++ b/publish-npm/README.md @@ -61,7 +61,7 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM ### With Trusted Publishers (preferred) -> ⚠️ this method requires npm >= 11.5.1, shipped with Node.js >= 24.5.0. Use a compatible `node-version`, or use the method with npm token. +> ⚠️ this method requires npm >= 11.5.1, shipped with Node.js >= 24.5.0. Use a compatible `node-version`, or provide the `npm-token` secret. 1. **Call the Reusable Workflow**