From 52c9ef45bbf7c61cd57304cf3b32ebb241f8e6fe Mon Sep 17 00:00:00 2001 From: Hunaid Hassan Date: Fri, 10 Jul 2026 17:48:56 +0200 Subject: [PATCH] ci: drop redundant 'npm install -g npm@latest' before publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Now that Node tracks latest LTS (24.x, bundling npm 11.x), this step is not just unnecessary — it is actively breaking the publish. Installing npm@latest over the toolcache npm produces a global install missing its bundled 'sigstore' dependency, so 'npm publish --provenance' crashes: npm error code MODULE_NOT_FOUND npm error Cannot find module 'sigstore' The npm bundled with a current LTS Node already supports provenance with sigstore intact, so publishing with it directly works. Removing the step fixes the publish and eliminates the last moving-version failure point. --- .github/workflows/npm-publish.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 348f022..af4c6b8 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -30,9 +30,6 @@ jobs: - name: Build run: npm run build - - name: Update npm for provenance support - run: npm install -g npm@latest - - name: Check if version is published id: check-version run: |