Problem
release.yml's publish-npm job, which holds id-token: write and the release environment, runs npm install -g --ignore-scripts npm@11.20.0, because OIDC trusted publishing needs npm >= 11.5.1 and Node 22 bundles npm 10.x. The install is pinned and runs no lifecycle scripts, but the downloaded npm CLI is then executed next to the publish credential, and it breaks the rule in AGENTS.md (Credentialed workflow jobs) that a job holding a publish credential installs nothing.
Raised by Copilot on the v1.0.0 merge PR #5090 (thread r4237133436). Present on main (looser: npm@^11.5.1), v2/main and v2/release/1.0.0.
Expected
The publish job gets an npm that meets the OIDC floor without installing one: actions/setup-node (SHA-pinned) with an exactly pinned Node 24 release, whose bundled npm is >= 11.5.1 (Node 24.21.0 bundles npm 11.19.0), and no npm install step. A step fails the job before publishing if the bundled npm is below 11.5.1. The build jobs keep Node 22.
Problem
release.yml'spublish-npmjob, which holdsid-token: writeand thereleaseenvironment, runsnpm install -g --ignore-scripts npm@11.20.0, because OIDC trusted publishing needs npm >= 11.5.1 and Node 22 bundles npm 10.x. The install is pinned and runs no lifecycle scripts, but the downloaded npm CLI is then executed next to the publish credential, and it breaks the rule inAGENTS.md(Credentialed workflow jobs) that a job holding a publish credential installs nothing.Raised by Copilot on the v1.0.0 merge PR #5090 (thread r4237133436). Present on
main(looser:npm@^11.5.1),v2/mainandv2/release/1.0.0.Expected
The publish job gets an npm that meets the OIDC floor without installing one:
actions/setup-node(SHA-pinned) with an exactly pinned Node 24 release, whose bundled npm is >= 11.5.1 (Node 24.21.0 bundles npm 11.19.0), and nonpm installstep. A step fails the job before publishing if the bundled npm is below 11.5.1. The build jobs keep Node 22.