ci(release): npm@latest preflight for OIDC + consume vestigial changeset (first-publish-ready)#41
Merged
Merged
Conversation
npm OIDC trusted publishing requires npm CLI >= 11.5.1. Node 24's bundled npm may be older. Install latest npm globally after setup-node and before pnpm changeset publish.
…esign A) The initial-release-0-1-0.md changeset was vestigial: its intent (minor bump to 0.1.0) is already encoded in the package.json versions. Deleting it prevents a `changeset version` double-bump to 0.2.0 (Design A manual versioning). Content preserved: codec CHANGELOG consolidated from two stub entries into one clean ## 0.1.0 section; types and networks CHANGELOGs expanded with changeset description text so the record is not lost.
…hade review) P0-1: bump packageManager to pnpm@11.5.1 (OIDC trusted publishing requires pnpm >= 11.0.7; .npmrc placeholder fix >= 11.1.3). pnpm/action-setup reads packageManager from root package.json — no explicit version: in workflows. engines.pnpm bumped to >=11 to match. pnpm 11 migration side-effects (required for frozen-lockfile to pass): - pnpm.overrides moved from package.json "pnpm" field to pnpm-workspace.yaml - allowBuilds added for @swc/core and esbuild (pnpm 11 build-approval gate) - pnpm install ran clean; lockfile unchanged (resolution skipped, up-to-date) P0-2: remove "npm install -g npm@latest" step — pnpm publishes, not npm; upgrading npm CLI version has no effect on OIDC trusted publishing. P1-1: re-pin actions/checkout to 9f698171 (real v6.0.3 SHA; prior pin df4cb1c resolved to mutable v6 tag but comment falsely said v6.0.3).
… source) ERR_PNPM_BAD_PM_VERSION fired in CI because pnpm/action-setup had version: 10.24.0 hardcoded while packageManager is now pnpm@11.5.1. Remove the version: input from all three pnpm/action-setup steps in ci.yml (lint-and-build, vector-parity, ts-rust-parity jobs) so action-setup reads the version from packageManager — one source, no conflict. release.yml was already fixed in the prior commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #17. Reworked after Shade co-review (P0-1, P0-2, P1-1).
What this changes
P0-1 — pnpm 11.5.1 (OIDC trusted publishing)
Bumps
packageManagerin rootpackage.jsonfrompnpm@10.24.0topnpm@11.5.1. pnpm OIDC trusted publishing landed in 11.0.7; the.npmrcplaceholder 404 fix in 11.1.3.pnpm/action-setupreadspackageManagerfrompackage.json— no explicitversion:needed in workflows; bothrelease.ymlandci.ymlpick it up automatically.engines.pnpmbumped to>=11to match.pnpm 11 migration side-effects (required for
--frozen-lockfileto pass in CI):pnpm.overridesmoved frompackage.json's"pnpm"field topnpm-workspace.yaml(pnpm 11 no longer reads the old location)allowBuildsadded for@swc/coreandesbuildinpnpm-workspace.yaml(pnpm 11 build-approval gate)pnpm installran clean; lockfile unchanged (resolution skipped, already up-to-date)pnpm install --frozen-lockfilepasses:Done in 384ms using pnpm v11.5.1P0-2 — Remove
npm install -g npm@latestDeleted the step added in the first round.
pnpm changeset publishuses pnpm to publish, not npm; upgrading the npm CLI has no effect on pnpm's OIDC trusted publishing. The step was a no-op and introduced a mutable dependency.P1-1 — Re-pin
actions/checkoutto real v6.0.3 SHAPrior pin
df4cb1c069e1874edd31b4311f1884172cec0e10resolved to the mutablev6major tag while the comment saidv6.0.3. Re-pinned to9f698171ed81b15d1823a05fc7211befd50c8ae0(real v6.0.3). Onlyrelease.ymlupdated (ci.yml same mis-pin is a separate P2 follow-up).Vestigial changeset removal (carried from first round — passed review)
Deletes
.changeset/initial-release-0-1-0.md. Content preserved in the threeCHANGELOG.mdfiles as proper## 0.1.0entries.changeset publishfires on the 0.0.0→0.1.0 version delta without achangeset versionstep (Design A manual versioning).Dry-run results
@void-layer/codec@void-layer/types@void-layer/networkspnpm install --frozen-lockfile→ exit 0 (pnpm v11.5.1, lockfile unchanged)pnpm -r build→ exit 0pnpm -w lint→ exit 0Do NOT merge until