Skip to content

Commit 1f23742

Browse files
Mudit-Lalclaude
Mudit-Lal
and
claude
committed
fix(ci): bootstrap npm 11 via official install script (npm 10 self-upgrade broken)
Run 24651461907 failed the npm upgrade step because npm 10.x's own install command is broken when self-upgrading: npm error MODULE_NOT_FOUND Cannot find module 'promise-retry' This is a known Node/npm issue where mid-upgrade the module tree is in an inconsistent state and the currently-running npm trips over its own dependencies. `npm install -g npm@latest` cannot rescue itself. Workaround: wipe the corrupted npm install, then fetch npm via its official install.sh script which downloads a clean tarball and wires bin shims directly (no dependency on the currently-installed npm CLI). Same upgrade intent as before — get to npm 11.5.1+ for Trusted Publisher OIDC. Just a different mechanism to reach it. Reference: nodejs/node#56341 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 2c1f6ee commit 1f23742

1 file changed

Lines changed: 21 additions & 7 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -79,15 +79,29 @@ jobs:
7979
registry-url: https://registry.npmjs.org
8080

8181
# Upgrade npm CLI to latest. Node 22 bundles npm 10.x, but npm
82-
# Trusted Publisher OIDC auth (the flow that maps our GitHub Actions
83-
# OIDC token against the trusted-publisher config on npmjs.com)
84-
# requires npm 11.5.1+. Without this, OIDC signing still succeeds
85-
# (sigstore gets the attestation) but the PUT to the registry fails
86-
# with a misleading E404 because npm 10 doesn't know how to exchange
87-
# the OIDC token for a publish session.
82+
# Trusted Publisher OIDC auth requires npm 11.5.1+. Without this,
83+
# OIDC signing still succeeds (sigstore attestation) but the PUT
84+
# to the registry fails with a misleading E404 because npm 10
85+
# doesn't know how to exchange the OIDC token for a publish session.
86+
#
87+
# npm 10's self-upgrade path is broken ("Cannot find module
88+
# 'promise-retry'") when the node_modules tree is midway through
89+
# install. Wipe npm's module tree and reinstall via node itself
90+
# (bypassing npm) — this is the workaround recommended by
91+
# nodejs/node#56341 and used by nodejs/setup-node internally.
8892
- name: Upgrade npm to 11+ (required for OIDC trusted publishing)
8993
run: |
90-
npm install -g npm@latest
94+
set -euo pipefail
95+
# Remove the corrupted npm 10.x install that's about to break
96+
# during self-upgrade.
97+
NODE_PREFIX=$(node -p "require('path').dirname(process.execPath) + '/..'")
98+
NPM_GLOBAL_DIR="$NODE_PREFIX/lib/node_modules/npm"
99+
echo "Removing corrupted npm at $NPM_GLOBAL_DIR"
100+
rm -rf "$NPM_GLOBAL_DIR"
101+
# Install npm fresh via node — use npm's official install script
102+
# which downloads a clean tarball and sets up bin shims without
103+
# relying on the removed npm CLI.
104+
curl -qL https://www.npmjs.com/install.sh | sh
91105
npm --version
92106
93107
- name: Install dependencies

0 commit comments

Comments
 (0)