ci: publish on Node 24 with a pinned npm

[JohnMcLear]

Publishing is broken across the whole plugin fleet and this is why.

The publish job runs npm install -g npm@latest on node-version: 25. npm 12 (released recently) requires Node ^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is excluded — so the step fails with EBADENGINE and the job dies before publishing anything:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

I checked all 79 plugin repos: 78 pin Node 25 and 76 use npm@latest, so npm 12's release broke every plugin's publish at once. (The comment in this file even said it wanted Node 20.x.)

Fix

• node-version: 24 — an LTS line supported by every npm 11.x and 12.x.
• npm@^11.5.1 instead of @latest — 11.5.1 is the floor for OIDC trusted publishing, and a range stops the next npm major silently breaking publishing again.

This is the pilot for a fleet-wide sweep; once it's confirmed working the same change goes to the other 78.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore npm publishing with Node 24 and constrained npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Run npm publishing on supported Node 24 LTS instead of incompatible Node 25.
• Constrain npm upgrades to 11.x while preserving OIDC trusted publishing support.

High-Level Assessment

The proposed combination is appropriate: Node 24 provides an npm-supported LTS runtime, while the ^11.5.1 range retains trusted-publishing support and patch/minor updates without exposing publishing to untested npm majors. An exact npm pin would improve reproducibility but require manual maintenance, while npm 12 would impose tighter Node patch-version coupling without providing a needed capability.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse Node 24 with a constrained npm 11 upgrade +9/-5

Use Node 24 with a constrained npm 11 upgrade

• Switches the publish runner from unsupported Node 25 to Node 24 LTS. Replaces npm@latest with ^11.5.1 to retain OIDC trusted publishing while preventing future npm major releases from unexpectedly breaking the workflow.

.github/workflows/npmpublish.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Publishing can break again unnoticed 📘 Rule violation ▣ Testability

Description

.github/workflows/npmpublish.yml replaces Node 25 and npm@latest with Node 24 and npm@^11.5.1,
but the diff adds no automated test that verifies this compatible version pairing. If either
selection is reverted or changed incompatibly, CI has no regression assertion before the publishing
path reaches the failing npm upgrade step.

Code

.github/workflows/npmpublish.yml[33]

+        run: npm install -g npm@^11.5.1

Evidence

PR Compliance ID 541890 requires every defect fix to add or update an automated test that fails when
the corrected behavior is reverted. The cited workflow contains the complete publishing fix, while
the diff contains no test modification exercising or asserting its Node/npm compatibility
constraint.

Rule 541890: Every bug fix must include a regression test
.github/workflows/npmpublish.yml[23-33]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The publishing bug fix changes the Node and npm versions without adding an automated regression test for the compatibility requirement that previously caused the upgrade step to fail.
## Fix Focus Areas
- .github/workflows/npmpublish.yml[23-33]
## Recommended Fix
Add an automated workflow configuration test that parses the publishing workflow and asserts the supported Node 24 selection and npm 11 range. Ensure the test fails if the workflow returns to Node 25, `npm@latest`, or another known-incompatible pairing.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Publishing can break again unnoticed 📘 Rule violation ▣ Testability

.github/workflows/npmpublish.yml replaces Node 25 and npm@latest with Node 24 and npm@^11.5.1,
but the diff adds no automated test that verifies this compatible version pairing. If either
selection is reverted or changed incompatibly, CI has no regression assertion before the publishing
path reaches the failing npm upgrade step.

Agent Prompt

## Issue description
The publishing bug fix changes the Node and npm versions without adding an automated regression test for the compatibility requirement that previously caused the upgrade step to fail.

## Fix Focus Areas
- .github/workflows/npmpublish.yml[23-33]

## Recommended Fix
Add an automated workflow configuration test that parses the publishing workflow and asserts the supported Node 24 selection and npm 11 range. Ensure the test fails if the workflow returns to Node 25, `npm@latest`, or another known-incompatible pairing.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools