ci: revert _publish-npm.yaml to @v7 - #95
Merged
Merged
Conversation
@v11's npm upgrade step is a no-op: `corepack prepare npm@latest --activate` records the version in COREPACK_HOME but does not put that npm on PATH, so publishing runs on the runner's bundled npm. That npm predates OIDC trusted publishing, falls through to the placeholder _authToken setup-node writes into .npmrc, and the registry reports the unauthorized publish as a misleading E404. Observed on ledger-filecoin-js v3.0.10: Current npm version: 10.9.8 Updated npm version: 10.9.8 npm error 404 '@zondax/ledger-filecoin@3.0.10' is not in this registry. @v7 uses `npm install -g npm@latest`, which does take effect. Stopgap only - revert this once Zondax/_workflows#114 lands and a new tag is cut.
VALIDATION - do not merge as-is. Repoints from @v7 to the branch behind Zondax/_workflows#114 so this PR's dry-run actually exercises the fix on ubuntu-latest. The fix was only verified locally on macOS; #114's own CI runs YAML lint and never executes the publish workflow, so nothing has proven that `corepack enable npm` behaves the same on a GitHub-hosted runner. What the dry-run should show: Current npm version: 10.9.8 Updated npm version: 12.x <- was 10.9.8 on @v11 and the npm >= 11.5.1 assertion passing. Once #114 merges and the v11 tag moves, this repo is fixed without any change on its side - close this PR then. If the tag is not moved, replace this ref with @v7 as the stopgap instead.
chcmedeiros
changed the title
Drops the temporary branch ref used to validate Zondax/_workflows#114. This PR is now purely the @v11 -> @v7 revert.
chcmedeiros
changed the title
0xPxt
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts the publish workflow from
_publish-npm.yaml@v11back to@v7.Why
@v11cannot publish to npm. Its npm upgrade step is a no-op —corepack prepare npm@latest --activaterecords the version inCOREPACK_HOMEbut does not put that npm on PATH, so publishing runs on the runner's bundled npm. That npm predates OIDC trusted publishing, so it falls through to the placeholder_authTokenthatsetup-nodewrites into.npmrc, and the registry reports the unauthorized publish as a misleadingE404.It has already cost two releases:
E404E404@v7usesnpm install -g npm@latest, which does take effect — confirmed the same day on a run reportingUpdated npm version: 12.0.1.Scope
Only the reusable workflow ref changes. Nothing else is touched.