From aeeaf9ffd5bcfe038bbd709bf5fd72cd2364e68f Mon Sep 17 00:00:00 2001
From: "omegent-app[bot]" <306514130+omegent-app[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:09:25 +0000
Subject: [PATCH 1/2] ci: use Node 24 latest for OIDC release runners

Pin setup-node to major 24 (latest 24.x) and keep npm@latest. Stale
24.14 pin made npm 12's engine check fail during the CLI upgrade.
---
 .github/npm-trusted-publishing.md |  4 +-
 .github/release.oidc.yaml         | 81 +++++++++++++++++++++++++++++++
 2 files changed, 83 insertions(+), 2 deletions(-)
 create mode 100644 .github/release.oidc.yaml

diff --git a/.github/npm-trusted-publishing.md b/.github/npm-trusted-publishing.md
index 981913178..e362669b1 100644
--- a/.github/npm-trusted-publishing.md
+++ b/.github/npm-trusted-publishing.md
@@ -82,8 +82,8 @@ git push
 That workflow includes:
 
 - `permissions.id-token: write`
-- npm CLI upgraded to latest (≥ `11.5.1` required for OIDC)
-- Node `24.14`
+- Node `24` (latest 24.x; npm 12 needs Node ≥ `24.15` — pin the major, not a stale patch like `24.14`)
+- Workflow upgrades to `npm@latest` after setup-node (OIDC needs npm ≥ `11.5.1`)
 - **No** `NPM_TOKEN` on the publish step
 - Package `repository.url` points at `https://github.com/effect-app/libs.git` (set in package.json)
 
diff --git a/.github/release.oidc.yaml b/.github/release.oidc.yaml
new file mode 100644
index 000000000..c225755de
--- /dev/null
+++ b/.github/release.oidc.yaml
@@ -0,0 +1,81 @@
+# Canonical Changesets workflow using npm Trusted Publishing (OIDC).
+# Live path: .github/workflows/release.yaml
+# If they diverge, prefer this file and copy:
+#   cp .github/release.oidc.yaml .github/workflows/release.yaml
+name: Changesets
+on:
+  push:
+    branches:
+      - main
+# id-token: write enables npm Trusted Publishing (OIDC).
+# Do not pass NPM_TOKEN on the publish step — changesets/action prefers a
+# long-lived token when set and will skip OIDC.
+# See .github/npm-trusted-publishing.md for npmjs.com setup.
+permissions:
+  contents: write
+  pull-requests: write
+  id-token: write
+env:
+  CI: true
+  PNPM_CACHE_FOLDER: .pnpm-store
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  version:
+    needs: [ci]
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout code repository
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Install Node.js
+        uses: actions/setup-node@v4
+        with:
+          # Major pin = latest 24.x (CI uses `latest`). npm@12 needs Node >= 24.15.
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      # Trusted publishing requires npm CLI >= 11.5.1; keep CLI current on this Node line.
+      - name: Ensure npm supports OIDC trusted publishing
+        run: npm install -g npm@latest && npm --version
+
+      - uses: pnpm/action-setup@v3
+        name: Install pnpm
+        id: pnpm-install
+        with:
+          run_install: false
+
+      - name: Get pnpm store directory
+        id: pnpm-cache
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
+
+      - uses: actions/cache@v4
+        name: Setup pnpm cache
+        with:
+          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+
+      - name: install packages
+        run: pnpm install --frozen-lockfile
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: create and publish versions
+        uses: changesets/action@v1
+        with:
+          version: pnpm ci:version
+          commit: "chore: update versions"
+          title: "chore: update versions"
+          publish: pnpm ci:publish
+          createGithubReleases: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 29b815fddd2cbebd38e7d216cd8788cb830c9eda Mon Sep 17 00:00:00 2001
From: "omegent-app[bot]" <306514130+omegent-app[bot]@users.noreply.github.com>
Date: Mon, 3 Aug 2026 11:13:12 +0000
Subject: [PATCH 2/2] ci: edit release.yaml in place for Node 24 + OIDC

Drop the release.oidc.yaml copy-over template; workflows can be updated
directly. Pin Node 24 (latest 24.x) and keep npm@latest on the live
Changesets workflow.
---
 .github/npm-trusted-publishing.md | 32 +++---------
 .github/release.oidc.yaml         | 81 -------------------------------
 .github/workflows/release.yaml    | 10 ++--
 3 files changed, 14 insertions(+), 109 deletions(-)
 delete mode 100644 .github/release.oidc.yaml

diff --git a/.github/npm-trusted-publishing.md b/.github/npm-trusted-publishing.md
index e362669b1..1d8ef5874 100644
--- a/.github/npm-trusted-publishing.md
+++ b/.github/npm-trusted-publishing.md
@@ -48,38 +48,21 @@ npm does **not** validate the config on save — mismatches only show up at publ
 ## Order of operations (important)
 
 1. **Configure trusted publishers** for all packages above (npm side).
-2. **Merge** the PR with package `repository` fields + this doc + `.github/release.oidc.yaml`.
-3. **Apply the workflow** (maintainer, local credentials with `workflows` permission):
-
-   ```bash
-   cp .github/release.oidc.yaml .github/workflows/release.yaml
-   git add .github/workflows/release.yaml && git commit -m "ci: enable npm OIDC trusted publishing" && git push
-   ```
-
-4. On push to `main`, the Changesets workflow publishes any unpublished versions (e.g. `4.0.0-beta.299`).
-5. Confirm success in the Actions log: look for  
+2. **Merge** the PR that enables OIDC in `.github/workflows/release.yaml` (`id-token: write`, no `NPM_TOKEN` on publish).
+3. On push to `main`, the Changesets workflow publishes any unpublished versions.
+4. Confirm success in the Actions log: look for  
    `No NPM_TOKEN found, but OIDC is available - using npm trusted publishing`.
-6. After a successful OIDC publish, optionally harden each package:
+5. After a successful OIDC publish, optionally harden each package:
    - **Publishing access** → **Require two-factor authentication and disallow tokens**
    - Revoke the old GitHub secret `NPM_TOKEN` and any automation tokens on npm.
 
 Do **not** set `NPM_TOKEN` on the publish step once OIDC is intended — `changesets/action` will use the long-lived token instead of OIDC when that env var is present.
 
-## GitHub workflow (apply once)
-
-The intended Changesets workflow lives at **`.github/release.oidc.yaml`**.
-
-A GitHub App without the `workflows` permission cannot update files under
-`.github/workflows/`. A maintainer must apply it once:
+## GitHub workflow
 
-```bash
-cp .github/release.oidc.yaml .github/workflows/release.yaml
-git add .github/workflows/release.yaml
-git commit -m "ci: enable npm OIDC trusted publishing in Changesets workflow"
-git push
-```
+Live workflow: **`.github/workflows/release.yaml`**.
 
-That workflow includes:
+It includes:
 
 - `permissions.id-token: write`
 - Node `24` (latest 24.x; npm 12 needs Node ≥ `24.15` — pin the major, not a stale patch like `24.14`)
@@ -94,6 +77,7 @@ That workflow includes:
 | `E404` / “could not be found or you do not have permission” | Trusted publisher mismatch (org/repo/workflow filename), or OIDC not used because `NPM_TOKEN` is still set |
 | `ENEEDAUTH` / unable to authenticate | Missing `id-token: write`, old npm CLI, or self-hosted runner (not supported) |
 | Only some packages publish | Trusted publisher missing on those packages |
+| `EBADENGINE` installing `npm@latest` | Node pin too old (e.g. `24.14`); use major `24` so runners are ≥ `24.15` |
 
 ## Optional hardening
 
diff --git a/.github/release.oidc.yaml b/.github/release.oidc.yaml
deleted file mode 100644
index c225755de..000000000
--- a/.github/release.oidc.yaml
+++ /dev/null
@@ -1,81 +0,0 @@
-# Canonical Changesets workflow using npm Trusted Publishing (OIDC).
-# Live path: .github/workflows/release.yaml
-# If they diverge, prefer this file and copy:
-#   cp .github/release.oidc.yaml .github/workflows/release.yaml
-name: Changesets
-on:
-  push:
-    branches:
-      - main
-# id-token: write enables npm Trusted Publishing (OIDC).
-# Do not pass NPM_TOKEN on the publish step — changesets/action prefers a
-# long-lived token when set and will skip OIDC.
-# See .github/npm-trusted-publishing.md for npmjs.com setup.
-permissions:
-  contents: write
-  pull-requests: write
-  id-token: write
-env:
-  CI: true
-  PNPM_CACHE_FOLDER: .pnpm-store
-jobs:
-  ci:
-    uses: ./.github/workflows/ci.yml
-
-  version:
-    needs: [ci]
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    steps:
-      - name: checkout code repository
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          # Major pin = latest 24.x (CI uses `latest`). npm@12 needs Node >= 24.15.
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-
-      # Trusted publishing requires npm CLI >= 11.5.1; keep CLI current on this Node line.
-      - name: Ensure npm supports OIDC trusted publishing
-        run: npm install -g npm@latest && npm --version
-
-      - uses: pnpm/action-setup@v3
-        name: Install pnpm
-        id: pnpm-install
-        with:
-          run_install: false
-
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        shell: bash
-        run: |
-          echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
-
-      - uses: actions/cache@v4
-        name: Setup pnpm cache
-        with:
-          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
-
-      - name: install packages
-        run: pnpm install --frozen-lockfile
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: create and publish versions
-        uses: changesets/action@v1
-        with:
-          version: pnpm ci:version
-          commit: "chore: update versions"
-          title: "chore: update versions"
-          publish: pnpm ci:publish
-          createGithubReleases: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2fcbd7fc8..ebf056acc 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,6 +1,3 @@
-# Intended contents of .github/workflows/release.yaml for npm Trusted Publishing (OIDC).
-# Apply with: cp .github/release.oidc.yaml .github/workflows/release.yaml
-# (Bot cannot push workflow file updates; a maintainer must apply this once.)
 name: Changesets
 on:
   push:
@@ -34,9 +31,14 @@ jobs:
       - name: Install Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 24.14
+          # Major pin = latest 24.x (CI uses `latest`). npm@12 needs Node >= 24.15.
+          node-version: 24
           registry-url: https://registry.npmjs.org
 
+      # Trusted publishing requires npm CLI >= 11.5.1; keep CLI current on this Node line.
+      - name: Ensure npm supports OIDC trusted publishing
+        run: npm install -g npm@latest && npm --version
+
       - uses: pnpm/action-setup@v3
         name: Install pnpm
         id: pnpm-install