ci: publish on Node 24 with a pinned npm

[JohnMcLear]

The bug

.github/workflows/npmpublish.yml ran the publish job on Node 25 and then
upgraded npm with npm install -g npm@latest. npm 12 requires
^22.22.2 || ^24.15.0 || >=26.0.0 — Node 25 is not in that range — so as soon
as npm 12 shipped, that step started dying:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

Every plugin's publish has been failing since.

The fix

• node-version: 25 → node-version: 24 — an LTS line that every npm 11.x
  and 12.x supports.
• npm@latest → npm@^11.5.1 — 11.5.1 is the floor OIDC trusted publishing
  needs. Pinning to a range rather than @latest means the next npm major
  dropping this Node line cannot silently break publishing fleet-wide again.
• Replaced the stale comment that still described Node 20.x.

No other change. Mirrors the merged pilot, ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore npm publishing with Node 24 and pinned npm 11

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Moves npm publishing from unsupported Node 25 to the Node 24 LTS line.
• Constrains npm upgrades to compatible 11.x releases supporting OIDC trusted publishing.
• Documents the engine mismatch and prevents future major-version publishing failures.

High-Level Assessment

The selected approach is appropriate: Node 24 is a supported LTS release, while npm's ^11.5.1 range preserves trusted-publishing support and receives compatible fixes without allowing npm 12 or later. An exact npm pin would be more deterministic but would require manual patch upgrades and provide little benefit here.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse compatible Node and npm versions for trusted publishing +9/-5

Use compatible Node and npm versions for trusted publishing

• The publish job now runs on Node 24 instead of unsupported Node 25 and installs npm from the ^11.5.1 range instead of npm@latest. Comments document the OIDC requirement, npm 12 engine incompatibility, and rationale for blocking automatic major upgrades.

.github/workflows/npmpublish.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗