ci: update-npm-cli #421
ci: update-npm-cli #421
Conversation
|
WalkthroughAdds a pre-install “Update npm” step (npm install -g npm@latest) to two jobs in .github/workflows/publish.yml, placing it before pnpm install in both the publish-or-pr and snapshot flows. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Commit/PR
participant GH as GitHub Actions
participant Runner as Job Runner
participant NPM as npm
participant PNPM as pnpm
Dev->>GH: Trigger publish-or-pr / snapshot
GH->>Runner: Start job
rect rgba(230,240,255,0.5)
note right of Runner: Pre-install phase (changed)
Runner->>NPM: npm install -g npm@latest
end
Runner->>PNPM: pnpm install
Runner->>Runner: Build / Test / Publish
Runner-->>GH: Job result
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Comment |
|
View your CI Pipeline Execution ↗ for commit d4d62eb
☁️ Nx Cloud last updated this comment at |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/publish.yml (1)
185-187: Repeat the version pin and guard here for consistency and stability.Mirror the same change in the snapshot job to avoid drift and surprises from
latest.Apply this diff:
- - name: Update npm - run: npm install -g npm@latest + - name: Update npm + run: npm install -g npm@^11.5.1Optionally add the same “Verify npm version” step here as well.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/publish.yml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: pr
🔇 Additional comments (1)
.github/workflows/publish.yml (1)
60-62: Pin npm to a safe range and enable provenance for the publish path.
- Replace floating
npm@latestin .github/workflows/publish.yml (lines 60–62) with a pinned, compatible range and add a guard. Apply:- - name: Update npm - run: npm install -g npm@latest + - name: Update npm + run: npm install -g npm@^11.5.1
- Optional CI check to enforce minimum npm:
- name: Verify npm version run: | required=11.5.1 current=$(npm -v) if [ "$(printf '%s\n' "$required" "$current" | sort -V | head -n1)" != "$required" ]; then echo "npm $current is less than required $required" exit 1 fi
- Found: package.json:18 contains
ci:release:pnpm publish -r --no-git-checks && changeset tag. No occurrences ofprovenancewere found in the repo output — ensure provenance is enabled for your publish flow (pnpm/changesets or npm via flags orpublishConfig.provenancein package.json).
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #421 +/- ##
=======================================
Coverage 56.19% 56.19%
=======================================
Files 32 32
Lines 2091 2091
Branches 353 353
=======================================
Hits 1175 1175
Misses 916 916 🚀 New features to boost your workflow:
|
|
Deployed a5d7d76 to https://ForgeRock.github.io/ping-javascript-sdk/pr-421/a5d7d76dc7ee86c709c6966870a63ed0ca54da8d branch gh-pages in ForgeRock/ping-javascript-sdk |
📦 Bundle Size Analysis📦 Bundle Size Analysis➖ No Changes➖ @forgerock/davinci-client - 34.5 KB 11 packages analyzed • Baseline from latest Legend🆕 New package ℹ️ How bundle sizes are calculated
🔄 Updated automatically on each push to this PR |
3 participants
JIRA Ticket
N/A
Description
Ok, have to force npm cli because it was defaulting to v10 and it needs to be 11.5.1 or >
https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow
Summary by CodeRabbit