Pin trusted publishing workflow runtime

[yazmorukyaz]

Pins the publish workflow to Node 22.14.0 and npm 11.5.1 so npm trusted publishing can use an OIDC-compatible npm CLI.

Also removes npm package-manager caching from the release publish workflow. This does not publish npm, create tags, or change package metadata.

Summary by CodeRabbit

• Chores
  • Updated build and publishing pipeline to use pinned Node.js and npm versions for improved consistency and reliability in release deployments.

[coderabbitai]

Warning

Review limit reached

@yazmorukyaz, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes and 37 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8266ac9c-1ce7-4e29-bdcc-aeacb2661a06

📥 Commits

Reviewing files that changed from the base of the PR and between 139f5b4 and 9010fe7.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

📝 Walkthrough

Walkthrough

This PR updates the npm publish workflow to use pinned versions of Node.js (22.14.0) and npm (11.5.1), removes automatic npm cache configuration, and adds a version verification step before publishing.

Changes

Publish Workflow Configuration

Layer / File(s)	Summary
Node.js and npm version configuration .github/workflows/publish.yml	The actions/setup-node step pins Node.js to 22.14.0 and removes the npm cache directive. A new step globally installs npm@11.5.1 and prints the installed version before continuing with the build, test, pack, and publish pipeline.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A rabbit hops through workflows bright,
With Node and npm pinned just right,
No cache confusion, versions clear,
The publish path is crystal here! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Pin trusted publishing workflow runtime' clearly and specifically describes the main change: pinning versions of Node.js and npm in the publish workflow for trusted publishing compatibility.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/trusted-publishing-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 25-26: Replace the standalone version log with an equality check
that fails the job if PATH resolves a different npm binary: after the existing
npm install -g npm@11.5.1 step replace the plain npm --version step with a shell
check that compares $(npm --version) to "11.5.1" and exits non‑zero (and prints
a clear error) when they differ so the workflow stops before npm ci/publish.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e109bf66-5e8f-4bdf-aaf5-5fc51f8299f6

📥 Commits

Reviewing files that changed from the base of the PR and between 0637aa1 and 139f5b4.

📒 Files selected for processing (1)

• .github/workflows/publish.yml