From 44b180190624b2cb1911870560658f6305a1ee9b Mon Sep 17 00:00:00 2001 From: Brent Date: Mon, 24 Aug 2026 16:55:24 -0400 Subject: [PATCH] chore(ci): adopt mise, move to Node 24 so npm can do OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm trusted publishing needs npm >= 11.5.1. Every workflow here pinned `node-version: 22`, which ships npm 10.9.x — so OIDC could never have worked regardless of npm-side configuration. Node 24.14.0 ships npm 11.9.0. `pnpm publish` delegates the registry PUT to the npm CLI on PATH (verified: it emits npm's own `npm notice` output), so npm's version is what gates OIDC, not pnpm's. pnpm is pinned at 10.34.5 and deliberately NOT 11.x — pnpm 11 regressed OIDC by no longer delegating (pnpm#11513). Toolchain versions move into mise.toml, read by mise locally and by jdx/mise-action in CI, so a developer's shell and the runner cannot drift. Pinned here: node = "24.14.0" Left on their existing actions on purpose: pnpm/action-setup (already reads the "packageManager" pin), dtolnay/rust-toolchain (rustup is canonical and mise defers to it), and actions/setup-dotnet (installs several SDKs side by side, which mise's single-version dotnet backend cannot do). Restored explicitly because actions/setup-node was providing them implicitly: the pnpm store cache, and the .npmrc token write that `registry-url:` performed. npm tries OIDC first and falls back to that token, so it stays until each package has a trusted publisher registered. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013YaefW6U442PHZf94fMAer --- .github/workflows/pr-checks.yml | 11 +++++------ .github/workflows/release.yml | 19 ++++++++++++++----- mise.toml | 11 +++++++++++ package.json | 2 +- 4 files changed, 31 insertions(+), 12 deletions(-) create mode 100644 mise.toml diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml index ffdbe061..78348ffe 100644 --- a/.github/workflows/pr-checks.yml +++ b/.github/workflows/pr-checks.yml @@ -15,13 +15,12 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: 22 - - - uses: pnpm/action-setup@v4 + # Toolchains come from mise.toml, read here by mise-action so the runner + # and a developer's shell resolve identical versions. + - name: Setup toolchains (mise) + uses: jdx/mise-action@v4 + - uses: pnpm/action-setup@v4 - name: Install dependencies run: pnpm install diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 20911e18..618da4f7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,12 +26,21 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 - - name: Setup node.js - uses: actions/setup-node@v4 + # Toolchains come from mise.toml, read here by mise-action so the runner + # and a developer's shell resolve identical versions. + - name: Setup toolchains (mise) + uses: jdx/mise-action@v4 + + - name: Locate pnpm store + run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV" + + - name: Cache pnpm store + uses: actions/cache@v4 with: - node-version: 22 - cache: 'pnpm' - + path: ${{ env.STORE_PATH }} + key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} + restore-keys: ${{ runner.os }}-pnpm-store- + - name: Install dependencies run: pnpm install diff --git a/mise.toml b/mise.toml new file mode 100644 index 00000000..4d5d00ac --- /dev/null +++ b/mise.toml @@ -0,0 +1,11 @@ +# Toolchain versions for this repo — read by mise locally and by +# jdx/mise-action in CI, so a developer's shell and the runner agree. +# +# Not listed here on purpose: +# pnpm -> package.json "packageManager". pnpm self-substitutes to that +# version regardless of which pnpm binary launches it, so a mise +# pin would be cosmetic and would drift. +# rust -> rust-toolchain.toml + dtolnay/rust-toolchain. rustup is canonical +# and mise defers to it anyway. +[tools] +node = "24.14.0" # ships npm 11.9.0 — required (>=11.5.1) for npm OIDC trusted publishing diff --git a/package.json b/package.json index 363d071f..e845b731 100644 --- a/package.json +++ b/package.json @@ -49,7 +49,7 @@ "peerDependencies": { "typescript": "^5.8.2" }, - "packageManager": "pnpm@10.6.1+sha512.40ee09af407fa9fbb5fbfb8e1cb40fbb74c0af0c3e10e9224d7b53c7658528615b2c92450e74cfad91e3a2dcafe3ce4050d80bda71d757756d2ce2b66213e9a3", + "packageManager": "pnpm@10.34.5", "engines": { "node": ">=20.0.0" },