From 6b388bf6d0b9dfb4f94bf214ca36f206404da8a1 Mon Sep 17 00:00:00 2001 From: eli Date: Fri, 30 Oct 2026 14:44:27 -0500 Subject: [PATCH 1/2] PER-18047: publish on Node 24 instead of upgrading npm on Node 20 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/node_sdk_publish.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/node_sdk_publish.yaml b/.github/workflows/node_sdk_publish.yaml index d3faf07a..1cb62dd9 100644 --- a/.github/workflows/node_sdk_publish.yaml +++ b/.github/workflows/node_sdk_publish.yaml @@ -21,12 +21,10 @@ jobs: - name: Setup Node.js uses: actions/setup-node@v4 with: - node-version: '20' + # Trusted Publishing needs Node 22.14+ and npm 11.5.1+; Node 24 ships both. + node-version: '24' registry-url: 'https://registry.npmjs.org' - - name: Upgrade npm for Trusted Publishing - run: npm install -g npm@latest && npm --version - - name: Set git user run: | git config --global user.email "eli@permit.io" From 9e0aec3799f87fc46da84e409ccd2a9fe2e85957 Mon Sep 17 00:00:00 2001 From: eli Date: Fri, 30 Oct 2026 15:24:15 -0500 Subject: [PATCH 2/2] PER-18047: pin the publish job's actions, drop checkout credentials, correct the Node comment Co-Authored-By: Claude Opus 5.5 --- .github/workflows/node_sdk_publish.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/node_sdk_publish.yaml b/.github/workflows/node_sdk_publish.yaml index 1cb62dd9..7cf8c80b 100644 --- a/.github/workflows/node_sdk_publish.yaml +++ b/.github/workflows/node_sdk_publish.yaml @@ -16,14 +16,17 @@ jobs: id-token: write # Required for npm Trusted Publishing (OIDC) steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - # Trusted Publishing needs Node 22.14+ and npm 11.5.1+; Node 24 ships both. + # Trusted Publishing needs Node 22.14+ and npm 11.5.1+; Node 24.5.0 and later ship both. node-version: '24' registry-url: 'https://registry.npmjs.org' + package-manager-cache: false - name: Set git user run: |