ci: fix npm publish (pin npm to 11.18.0 — npm 12 breaks provenance/sigstore)#65
Merged
Conversation
…ailure)
The Release job upgraded npm via `npm install -g npm@latest`, which now
resolves to npm 12.0.0. npm 12.0.0 ships libnpmpublish's provenance.js —
which `require('sigstore')` — but does NOT bundle the sigstore module, so
`changeset publish` fails during provenance generation with
"npm error Cannot find module 'sigstore'" and no packages are published
(run 29007036403). Verified by unpacking the tarballs: sigstore is bundled
in npm 11.5.1 and 11.18.0, missing in 12.0.0.
Pin to [email protected] (latest 11.x, >= the 11.5.1 trusted-publishing minimum,
sigstore bundled). Merging this to main re-triggers Release, which publishes
the already-versioned-but-unpublished packages ([email protected], [email protected],
[email protected], [email protected], [email protected], [email protected]).
✅ Deploy Preview for contentrain-ai ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why the last release didn't publish
Run 29007036403 passed lint/typecheck/build/test/release-checks but failed on
Create release PR or publishwith:The version PR had already merged (changesets consumed), so the job took the "publish any unpublished packages" path — and crashed while generating provenance. This is not an auth/OIDC problem; auth succeeded.
Root cause
The job upgraded npm with
npm install -g npm@latest, which now resolves to npm 12.0.0. npm 12.0.0 shipslibnpmpublish/lib/provenance.js(whichrequire('sigstore')) but does not bundle thesigstoremodule — so provenance generation dies withCannot find module 'sigstore'.Verified by unpacking the tarballs:
sigstore?@latestjumped past the 11.x line the pipeline was written for (the step comment even says "requires >= 11.5.1").Fix
Pin
[email protected](latest 11.x — above the 11.5.1 trusted-publishing minimum, sigstore bundled) instead of@latest.After merge
Release triggers on push to
main, so merging this PR re-runs Release and publishes the already-versioned packages listed above. No manual re-tag needed. (Optionally run the workflow viaworkflow_dispatchif the push trigger is skipped.)🤖 Generated with Claude Code