From 793e108a5c6d431b1bae703d7b7ab5a87a7adc32 Mon Sep 17 00:00:00 2001 From: only-cli Date: Mon, 24 Aug 2026 12:49:50 -0400 Subject: [PATCH] chore: drop the npm self-upgrade from the publish workflow Node 24 has bundled an npm new enough for trusted publishing since 24.4, so upgrading npm at publish time only added an unpinned install to the release path. If a runner ever serves an older 24.x, npm publish fails loudly rather than shipping anything. --- .github/workflows/publish.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index c13fde5..006e846 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -42,9 +42,8 @@ jobs: - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - # Trusted publishing needs npm 11.5.1 or newer, pinned exactly so a - # release never runs an npm nobody reviewed. - - run: npm install -g npm@12.0.2 + # Trusted publishing needs npm 11.5.1 or newer; node 24 has bundled a + # new-enough npm since 24.4, so nothing extra is installed here. - run: npm ci - run: npm test - name: pick channel and version