ci(release): run publish on Node 24 (bundled npm 11.16, OIDC-ready)#229
Conversation
Node 24 ships npm >= 11.5.1 natively, so trusted publishing works without a global 'npm install -g npm@X' step. Drops that unpinned install (Scorecard Pinned-Dependencies) and the version to maintain; the build/test job stays on Node 22. Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
|
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe release workflow’s publish job now uses Node.js 24 instead of 22, updates its comments for bundled npm support, and removes the separate global npm pinning step. ChangesRelease Workflow Update
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Bundle ReportBundle size has no change ✅ |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
1 similar comment
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #229 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 16 16
Lines 531 531
Branches 142 142
=========================================
Hits 531 531 Continue to review full report in Codecov by Harness.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 55-61: The publish job’s Node setup still enables npm caching via
the Setup Node 24 step, which should be disabled for trusted publishing. Update
the actions/setup-node configuration in the release workflow to remove the npm
cache setting from the setup step used by the publish job, keeping the Node 24
OIDC setup intact but without package-manager caching.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 01a91824-1ad6-4fd0-999b-bd6c401b5cca
📒 Files selected for processing (1)
.github/workflows/release.yml
Address CodeRabbit: keep the trusted-publishing job's setup-node minimal (no package-manager cache). Signed-off-by: Claude Perrin <klodr@users.noreply.github.com>
|
@coderabbitai resolve |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
1 similar comment
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
✅ Action performedComments resolved and changes approved. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 532d0ddd76
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # No npm cache here: keep the publish job's environment minimal | ||
| # for OIDC trusted publishing (per CodeRabbit review). |
There was a problem hiding this comment.
In this privileged publish job, removing the cache input does not actually make the setup cache-free: actions/setup-node v6 documents that npm caching is automatically enabled when package.json has a top-level packageManager set to npm, unless package-manager-cache: false is provided. Since this repo declares packageManager: npm@10.9.7, the job will still restore/save the npm cache despite the new “No npm cache here” comment; add the explicit input if the OIDC publish environment must stay minimal.
Useful? React with 👍 / 👎.
1 participant
Même correction que gmail-mcp#247 : Node 24 embarque npm 11.16 (≥ 11.5.1 requis pour l'OIDC), donc le step
npm install -gnon épinglé est retiré (alerte Scorecard Pinned-Dependencies). Build/test reste sur Node 22.Summary by CodeRabbit