ci: publish on Node 24 with a pinned npm

[JohnMcLear]

The publish job ran on Node 25 and then ran npm install -g npm@latest. npm 12 requires Node ^22.22.2 || ^24.15.0 || >=26.0.0, which excludes Node 25, so once npm 12 shipped that step died with EBADENGINE and this package could no longer be published:

npm error code EBADENGINE
npm error Not compatible with your version of node/npm: npm@12.0.2
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual:   {"node":"v25.9.0","npm":"11.12.1"}

This moves the job to Node 24 (an LTS line every npm 11.x and 12.x supports) and pins the upgrade to npm@^11.5.1 — a range rather than @latest, so the next npm major dropping this Node line cannot silently break publishing fleet-wide again. npm >= 11.5.1 is what OIDC trusted publishing needs.

Same fix as the pilot, ether/ep_align#227.

🤖 Generated with Claude Code

https://claude.ai/code/session_013S4pYSjwUsiZtdtMMpW7bw

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can add REVIEW.md to your repo root and Qodo follows it on every PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Restore npm publishing with Node 24 and a bounded npm 11 range

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Moves trusted publishing from unsupported Node 25 to the Node 24 LTS line.
• Bounds npm upgrades to compatible 11.x releases while preserving OIDC publishing support.
• Prevents future npm major releases from unexpectedly breaking package publication.

Diagram

graph TD
  A["Publish Job"] -->|configures| B["Node 24 LTS"] -->|runs| C["npm 11 Range"] -->|OIDC publish| D["npm Registry"]

Loading

High-Level Assessment

The selected approach is appropriate: Node 24 provides a supported LTS runtime, while npm@^11.5.1 guarantees the minimum OIDC capability without accepting a potentially incompatible future major. Relying on the bundled npm or npm@latest would reintroduce version drift, while an exact npm pin would unnecessarily exclude compatible npm 11 fixes.

Files changed (1) +9 / -5

Bug fix (1) +9 / -5

npmpublish.ymlUse compatible Node and npm versions for trusted publishing +9/-5

Use compatible Node and npm versions for trusted publishing

• Changes the publication runtime from Node 25 to Node 24 and bounds the npm upgrade to ^11.5.1. Expanded comments document the EBADENGINE failure and explain why unrestricted npm upgrades are unsafe.

.github/workflows/npmpublish.yml