chore(ci): ensure latest npm is installed for verified publishing#319
Conversation
|
Related Documentation Checked 7 published document(s) in 1 knowledge base(s). No updates required. How did I do? Any feedback? |
WalkthroughAdded a new step to the publish job in the CI/CD workflow to install the latest npm version before executing the publish command. This ensures a recent npm is available during the publication process. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Tip We've launched Issue Planner and it is currently in beta. Please try it out and share your feedback on Discord! Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/main.yaml (1)
110-110:⚠️ Potential issue | 🟠 MajorBug:
env.NODE_VERSIONis undefined — should beenv.TARGET_NODE_VERSION.The workflow defines
TARGET_NODE_VERSION(line 13), but this line referencesNODE_VERSION, which doesn't exist. This causes the publish job to fall back to the runner's default Node.js version instead of the intended 24.x. Other jobs (test, audit) correctly useTARGET_NODE_VERSION.Pre-existing issue, but directly relevant since this PR touches the publish job.
Proposed fix
- node-version: ${{ env.NODE_VERSION }} + node-version: ${{ env.TARGET_NODE_VERSION }}
🧹 Nitpick comments (1)
.github/workflows/main.yaml (1)
147-148: Consider pinning to a major version range instead of@latest.Using
npm@latestis fine for now, but a future major-version bump could introduce breaking changes mid-release. Pinning to a major range (e.g.,npm@^11) would still get you the latest compatible version while guarding against surprise breakage.That said, the change achieves its goal and this is a common CI pattern.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #319 +/- ##
=======================================
Coverage 89.55% 89.55%
=======================================
Files 25 25
Lines 1475 1475
Branches 254 277 +23
=======================================
Hits 1321 1321
Misses 93 93
Partials 61 61 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Updates the release publishing workflow to install the latest npm before running npm publish, aiming to support “verified/trusted” npm publishing behavior in CI.
Changes:
- Adds a workflow step in the
publishjob to installnpm@latestglobally prior to publishing.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Description
What problem is being solved?
How is it being solved?
What changes are made to solve it?
References
Review Checklist
mainSummary by CodeRabbit