fix(ci): bump CI Node.js to 24 to restore npm 11 trusted publishing by rocketstack-matt · Pull Request #2414 · finos/architecture-as-code

rocketstack-matt · 2026-05-04T19:08:53Z

Description

Bumps the Node.js version pinned in every CI workflow from 22 to 24 to restore npm Trusted Publishing (OIDC), which has been silently broken since #2397 was merged.

Root cause

@finos/calm-cli@1.39.0 did not publish to npm on 2026-05-02 (run 25255770432). The Publish to NPM step failed with:

npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@finos%2fcalm-cli - Not found
npm error 404 '@finos/calm-cli@1.39.0' is not in this registry.

This is npm's masked-403 response when the auth identity is not authorized to publish a scoped package. Querying the registry confirms the last successful publish (1.37.0, 2026-04-01) used Trusted Publishing rather than the bearer token:

$ npm view @finos/calm-cli
_npmUser: GitHub Actions <npm-oidc-no-reply@github.com>

OIDC trusted publishing requires npm 11.5+. Node 22.22.x ships npm 10.9.7, so since #2397 removed the npm install -g npm@11 step the publish job has been quietly falling back to bearer-token auth.

Why Node 24 (not re-add the global upgrade)

The npm install -g npm@11 step was removed in #2397 because it crashed mid-install on Node 22 with Cannot find module 'promise-retry' - a known regression in npm 10.9.7's self-upgrade path. Reintroducing it would flip back to the previously-broken state. Node 24 ships npm 11 in-the-box, ending the cycle.

Other notes:

Root package.json already declares node: \"^22.14.0 || >=24.10.0\", so no engines change is required.
Per-workspace engines fields (docs, calm-suite/calm-studio, calm-suite/calm-studio/docs-site, calm-suite/calm-guard/docs) all accept >=20.
Node 22 reaches EOL in April 2027; Node 24 is the current Active LTS line.

Normalization

While here, the mix of node-version: v22, 22, '22', and ['22.x'] across 21 workflow files has been normalized to a single node-version: 24 (matrix entry kept as ['24.x']).

Type of Change

🐛 Bug fix (non-breaking change which fixes an issue)
🔧 Chore (maintenance, dependencies, CI, etc.)

Affected Components

CI/CD

Testing

I have tested my changes locally
I have added/updated unit tests
All existing tests pass

CI on this PR will exercise every affected workflow. To fully verify the publish path, after merge the next cli-v1.x.x release run should show _npmUser: GitHub Actions <npm-oidc-no-reply@github.com> again on the published version. Recommend cutting cli-v1.39.1 to re-exercise the path - the cli-v1.39.0 git tag and GitHub Release already exist (publish silently dropped at the npm step), and a patch release is cleaner than retrofit-publishing the same version.

Checklist

My commits follow the conventional commit format
I have updated documentation if necessary
I have added tests for my changes (if applicable)
My changes follow the project's coding standards

Node 22.22.x ships npm 10.9.7, which lacks the OIDC trusted-publishing support added in npm 11.5+. Without npm 11 the publish step silently falls back to bearer-token auth, and the registry returns HTTP 404 (its masked-403 response) - which is what blocked @finos/calm-cli@1.39.0 from publishing on 2026-05-02. The previous remediation in finos#2397 removed the broken `npm install -g npm@11` self-upgrade step on the assumption it was unnecessary. It is necessary - just unstable on Node 22 where the self-upgrade crashes with `Cannot find module 'promise-retry'`. Node 24 ships npm 11 in-the-box, fixing trusted publishing without resurrecting the brittle self-upgrade step. While here, normalize the mix of `v22`, `22`, `'22'`, and `['22.x']` forms across the 21 workflow files to a single `node-version: 24` (matrix entry kept as `['24.x']`). Root package.json already declares `^22.14.0 || >=24.10.0`, so no engines change is required.

Copilot

Pull request overview

Updates the repository’s GitHub Actions workflows to run on Node.js 24 instead of Node.js 22, primarily to restore npm Trusted Publishing (OIDC) behavior by ensuring a sufficiently new bundled npm is available during release/publish jobs.

Changes:

Bumped actions/setup-node inputs across CI workflows from Node 22 → Node 24.
Normalized the various Node version formats used in workflows (e.g., v22, '22', 22.x) to a consistent Node 24 style (keeping matrices as 24.x where used).
Updated the automated release workflows (CLI + CALM Server + CALM Studio) to use Node 24 for their build/publish paths.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/validate-spectral.yml	Runs Spectral validation under Node 24.
.github/workflows/validate-renovate.yml	Runs Renovate config validation under Node 24.
.github/workflows/validate-lockfile.yml	Runs lockfile platform validation under Node 24.
.github/workflows/s3-docs-sync.yml	Uses Node 24 for docs build/sync job environment.
.github/workflows/license-scanning-node.yml	Updates the Node matrix from 22.x to 24.x for license scanning.
.github/workflows/cve-scanning-node.yml	Uses Node 24 for node-based CVE scanning/build step.
.github/workflows/build-vscode-extension.yml	Builds/packages/publishes the VS Code extension under Node 24.
.github/workflows/build-shared.yml	Builds/tests shared workspace under Node 24.
.github/workflows/build-docs.yml	Builds docs workspace under Node 24.
.github/workflows/build-cli.yml	Builds/tests CLI workspace under Node 24.
.github/workflows/build-calm-widgets.yml	Builds/tests calm-widgets workspace under Node 24.
.github/workflows/build-calm-studio.yml	Builds/lints/tests + E2E for CALM Studio under Node 24.
.github/workflows/build-calm-studio-desktop.yml	Desktop build jobs for CALM Studio under Node 24.
.github/workflows/build-calm-server.yml	Builds/tests CALM Server under Node 24.
.github/workflows/build-calm-models.yml	Builds/tests calm-models under Node 24.
.github/workflows/build-calm-hub-ui.yml	Builds/tests calm-hub-ui under Node 24.
.github/workflows/build-calm-guard.yml	Builds/tests calm-guard under Node 24.
.github/workflows/build-and-sync-advent.yml	Uses Node 24 for Advent-of-CALM build/sync workflow.
.github/workflows/automated-release.yml	CLI automated release/publish workflow now runs Node 24 throughout.
.github/workflows/automated-release-calm-studio.yml	CALM Studio automated release workflow now runs Node 24.
.github/workflows/automated-release-calm-server.yml	CALM Server automated release/publish workflow now runs Node 24 throughout.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

rocketstack-matt · 2026-05-04T19:41:20Z

        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: 22
+          node-version: 24


Thanks - acknowledged but not making the change.

actions/setup-node@v6 with node-version: 24 resolves to the latest 24.x in the GitHub-hosted runner toolcache, which on ubuntu-latest is well above 24.10 today. There is no realistic resolution path to an earlier 24.x minor on hosted runners. Node 24.0.0 already shipped with npm 11.3 and 24.10 ships npm 11.5+, so Trusted Publishing is satisfied at the floor regardless.

Pinning only the publish jobs to 24.10.x would also create a drift between the publish toolchain and the build/test toolchain that produces the artifact we publish, which feels worse than the theoretical reproducibility win.

rocketstack-matt · 2026-05-04T19:41:22Z

        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
-          node-version: 22
+          node-version: 24


Thanks - acknowledged but not making the change.

actions/setup-node@v6 with node-version: 24 resolves to the latest 24.x in the GitHub-hosted runner toolcache, which on ubuntu-latest is well above 24.10 today. There is no realistic resolution path to an earlier 24.x minor on hosted runners. Node 24.0.0 already shipped with npm 11.3 and 24.10 ships npm 11.5+, so Trusted Publishing is satisfied at the floor regardless.

Pinning only the publish jobs to 24.10.x would also create a drift between the publish toolchain and the build/test toolchain that produces the artifact we publish, which feels worse than the theoretical reproducibility win.

rocketstack-matt · 2026-05-04T20:21:14Z

@markscott-ms can you please take a look if you get a min

Renovate's hosted runner uses npm 10 by default, which raises EOVERRIDE when re-resolving the workspace tree against the dompurify override (`^3.4.0`) and other caret-range overrides. The lockfile regen step then aborts and Renovate ships package.json updates with a stale package-lock.json, breaking every npm-based CI job on the resulting PR. npm 11.5+ handles the same overrides scenario without erroring. Adding `packageManager: npm@11.12.1` is the standard Corepack-honored signal to pick a specific npm; Renovate respects it, and it also pins local dev and any non-explicit CI step onto the same npm so all three stay aligned. Closes #2415. Sequenced after #2414 (CI Node 24 / npm 11).

Copilot AI review requested due to automatic review settings May 4, 2026 19:08

rocketstack-matt requested a review from a team as a code owner May 4, 2026 19:08

Copilot started reviewing on behalf of rocketstack-matt May 4, 2026 19:09 View session

Copilot AI reviewed May 4, 2026

View reviewed changes

rocketstack-matt mentioned this pull request May 4, 2026

Renovate patch-update PRs ship out-of-sync package-lock.json (npm 10 EOVERRIDE) #2415

Closed

rocketstack-matt requested review from markscott-ms May 4, 2026 20:20

rocketstack-matt mentioned this pull request May 4, 2026

fix(ci): pin npm to 11.12.1 via packageManager field #2416

Merged

28 tasks

LeighFinegold approved these changes May 5, 2026

View reviewed changes

LeighFinegold merged commit 16a442d into finos:main May 5, 2026
26 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): bump CI Node.js to 24 to restore npm 11 trusted publishing#2414

fix(ci): bump CI Node.js to 24 to restore npm 11 trusted publishing#2414
LeighFinegold merged 1 commit intofinos:mainfrom
rocketstack-matt:fix/2397-node-24-trusted-publishing

rocketstack-matt commented May 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

rocketstack-matt May 4, 2026

Uh oh!

rocketstack-matt May 4, 2026

Uh oh!

rocketstack-matt commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rocketstack-matt commented May 4, 2026

Description

Root cause

Why Node 24 (not re-add the global upgrade)

Normalization

Type of Change

Affected Components

Testing

Checklist

Related

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

rocketstack-matt May 4, 2026

Choose a reason for hiding this comment

Uh oh!

rocketstack-matt May 4, 2026

Choose a reason for hiding this comment

Uh oh!

rocketstack-matt commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants