From 740fed437eab94a803437bf654e5a5d487ec2cf5 Mon Sep 17 00:00:00 2001
From: Lior Kanfi <lior@tikalk.com>
Date: Wed, 12 Aug 2026 16:31:39 +0300
Subject: [PATCH] fix(ci): upgrade npm to >=11 for Trusted Publishing (OIDC
 requires 11.5.1+)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Node 22 ships npm 10.9.8, but npm Trusted Publishing (OIDC) requires
npm CLI >= 11.5.1. The provenance signing worked (via sigstore) but
OIDC auth was silently skipped — npm 10.x doesn't support it.

Add a step to upgrade npm to latest before publishing.
---
 .github/workflows/publish.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bb6532c..7586b8e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,6 +42,9 @@ jobs:
           registry-url: https://registry.npmjs.org
           package-manager-cache: false
 
+      - name: Upgrade npm for Trusted Publishing (OIDC requires npm >= 11.5.1)
+        run: npm install -g npm@latest
+
       - name: Verify tag matches package version
         run: |
           TAG="${GITHUB_REF#refs/tags/v}"