Tags: coveo/cli
Tags
ci: install npm 11 so trusted publishing can authenticate (#1558) Top of a 2-PR stack, on top of #1559 (which fixes the cli/core unit tests). Follow-up to #1557. ## Problem The release still can't publish `@coveo/cli@3.3.0`. #1557 removed the placeholder npm token, turning the misleading `E404 PUT /@coveo%2fcli` into an honest `ENEEDAUTH`, which surfaced the real blocker: the publish runs with **npm 9.6.5**, and [trusted publishing requires npm >= 11.5.1](https://docs.npmjs.com/trusted-publishers). `npm run` prepends `node_modules/.bin` to `PATH`, and npm itself is a dependency of this repo. So every nested `npm` call in the release script — including the `npm publish` that `changeset publish` spawns — resolved to the hoisted npm 9.6.5 instead of the runner's npm 11.12.1: ``` action -> /opt/hostedtoolcache/.../npm run release npm@11.12.1 ok release -> npm run build && changeset publish npm verb cli .../node_modules/.bin/npm npm info using npm@9.6.5 not ok ``` npm 9 has no `lib/utils/oidc.js`, so the token exchange was never attempted. That's also why the verbose logging added in #1557 produced no `oidc` lines — nothing to log. ## Solution - Add `npm: 11.19.0` as a root devDependency. A root direct dependency deterministically owns `node_modules/npm`, so the copy on `PATH` is OIDC-capable. - Pin `utils/do-npm` to the same exact version so it dedupes instead of nesting a second copy. It only spawns npm as a CLI, so it doesn't rely on npm 9 internals. Bumping npm means editing both files. - Declare `do-npm`'s npm as a **devDependency**. It's only ever spawned as a CLI by private tooling, and leaving it in `dependencies` marked the whole bundled npm tree as runtime scope, which failed Dependency Review (`fail_on_scopes: runtime`) on the high-severity brace-expansion advisory GHSA-rgw5-rvv9-x895. No npm release carries the fix yet — 11.19.0 and 12.0.2 both bundle brace-expansion 5.0.7, fixed only in 5.0.9. `npm ci` still installs devDependencies, so `node_modules/.bin/npm` is 11.19.0 during release. The lockfile diff is large but shallow: npm bundles its dependencies, so replacing npm 9's tree with npm 11's rewrites thousands of entries. Outside npm's own tree only 3 entries move, and the lockfile was regenerated with npm 11 (the version CI runs) to avoid unnecessary drift. ## Why this depends on #1559 Bumping npm also restores correct exit-code propagation. nx runs each package's `test` script through npm workspaces, and npm 9.6.5 printed the failure but still exited 0, so nx reported success on a red suite. From a green `master` run: ``` Test Suites: 12 failed, 36 passed, 48 total Tests: 131 failed, 320 passed, 451 total npm ERR! Lifecycle script `test` failed with error: npm ERR! in workspace: @coveo/cli@3.3.0 > NX Successfully ran target test for 8 projects ``` On its own this PR would therefore turn CI red without breaking anything — it just stops npm from hiding 121 pre-existing failures. #1559 fixes those, and with it in the stack this PR is green. ## Verification CI green. `npm ci` resolves `node_modules/npm` to 11.19.0 with `lib/utils/oidc.js` present, `node_modules/.bin/npm --version` reports 11.19.0, `npm ls npm` shows a single deduped tree, and `npm run build` passes all 11 projects. `3.3.0` was never published, so re-running the release after merge retries cleanly.
[version bump] chore(release): release release-31 [skip ci] **/README.md **/CHANGELOG.md **/package.json **/*.snap README.md CHANGELOG.md package.json package-lock.json packages/ui/cra-template/template.json
[version bump] chore(release): release release-30 [skip ci] **/README.md **/CHANGELOG.md **/package.json **/*.snap README.md CHANGELOG.md package.json package-lock.json packages/ui/cra-template/template.json
PreviousNext