ci: publish on Node 24 with a pinned npm

[JohnMcLear]

The bug

publish-npm ran on node-version: 25 and then npm install -g npm@latest.
npm 12 requires ^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is excluded — so
the upgrade step died and this package could never be published:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

The fix

• node-version: 25 → 24 (an LTS line every npm 11.x and 12.x supports).
• npm@latest → npm@^11.5.1 — a range, not @latest, so the next npm major
  dropping this Node line can't silently break publishing fleet-wide again.
  11.5.1 is the minimum for OIDC trusted publishing.
• Replaced the stale comment that still described Node 20.x.

No other change. Same fix as the merged pilot, ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Fix npm publishing with Node 24 and bounded npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Runs publishing on Node 24 LTS to prevent npm engine compatibility failures.
• Constrains npm to OIDC-compatible 11.x releases instead of unbounded latest.

Diagram

sequenceDiagram
  participant R as Publish job
  participant S as setup-node
  participant N as npm CLI
  participant G as npm registry
  R->>S: Install Node 24
  S-->>R: Supported runtime
  R->>N: Install npm 11.x
  N-->>R: OIDC-ready CLI
  R->>G: Trusted publish

Loading

High-Level Assessment

The selected approach is appropriate: Node 24 is an npm-supported LTS line, while the caret range admits npm 11 fixes without crossing into incompatible future majors. An exact npm pin would improve reproducibility but require unnecessary manual maintenance.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse compatible Node and npm versions for trusted publishing +9/-5

Use compatible Node and npm versions for trusted publishing

• Switches the publishing runtime from unsupported Node 25 to Node 24 LTS. Bounds npm upgrades to OIDC-capable 11.x releases and documents why unbounded latest versions can break publishing.

.github/workflows/npmpublish.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Publishing remains unprotected by regression tests 📘 Rule violation ▣ Testability

Description

The workflow changes the Node.js version and npm upgrade range to fix a failed publishing path, but
the pull request adds or updates no automated test for the incompatible-runtime scenario. A future
Node or npm change can reintroduce the engine failure without a test exercising the publishing
setup.

Code

.github/workflows/npmpublish.yml[R23-33]

+          # OIDC trusted publishing needs npm >= 11.5.1. Node 24 is an LTS
+          # line that every npm 11.x and 12.x supports; Node 25 is not —
+          # npm 12 requires ^22.22.2 || ^24.15.0 || >=26.0.0, so on Node 25
+          # the upgrade step below died with EBADENGINE and no plugin could
+          # publish.
+          node-version: 24
         registry-url: https://registry.npmjs.org/
+        # Pinned to a range rather than @latest: the next npm major dropping
+        # this Node line would silently break publishing fleet-wide again.
     - name: Upgrade npm to >=11.5.1 (required for trusted publishing)
-        run: npm install -g npm@latest
+        run: npm install -g npm@^11.5.1

Evidence

The checklist requires every bug fix to include a focused automated regression test covering the
previously broken scenario. The PR description identifies an EBADENGINE publishing failure and the
diff changes the runtime and npm installation command, but the supplied change set contains no test
file or test modification.

Rule 565729: Require regression tests alongside every bug fix commit
.github/workflows/npmpublish.yml[23-33]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The publishing workflow fixes an npm and Node.js engine incompatibility, but no automated regression test covers the previously failing setup.
## Fix Focus Areas
- .github/workflows/npmpublish.yml[23-33]
## Recommended Fix
Add an appropriate automated workflow or configuration test that exercises the publishing job with the supported Node.js version and npm range, and asserts that the selected npm version is compatible with that runtime and the trusted-publishing requirement.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

1. Publishing remains unprotected by regression tests 📘 Rule violation ▣ Testability

The workflow changes the Node.js version and npm upgrade range to fix a failed publishing path, but
the pull request adds or updates no automated test for the incompatible-runtime scenario. A future
Node or npm change can reintroduce the engine failure without a test exercising the publishing
setup.

Agent Prompt

## Issue description
The publishing workflow fixes an npm and Node.js engine incompatibility, but no automated regression test covers the previously failing setup.

## Fix Focus Areas
- .github/workflows/npmpublish.yml[23-33]

## Recommended Fix
Add an appropriate automated workflow or configuration test that exercises the publishing job with the supported Node.js version and npm range, and asserts that the selected npm version is compatible with that runtime and the trusted-publishing requirement.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools