fix: fix npm ci failing with EBADPLATFORM due to npm 11 bug

[serhalp]

Summary

v23.10.0 introduced a bug where a user with netlify-cli in their package.json dependencies (or dev deps) who ran npm ci encountered an error like this:

npm error code EBADPLATFORM
npm error notsup Unsupported platform for @rollup/rollup-android-arm-eabi@4.52.2: wanted {"os":"android","cpu":"arm"} (current: {"os":"darwin","cpu":"arm64"})
npm error notsup Valid os:   android
npm error notsup Actual os:  darwin
npm error notsup Valid cpu:  arm
npm error notsup Actual cpu: arm64

Strictly speaking, we didn't introduce a bug, but we happened to introduce the necessary conditions to trigger an existing, latent npm CLI bug.

This PR fixes that bug and introduces multiple guardrails to prevent this type of issue in the future.

You can confirm with this prerelease: netlify-cli@23.11.1-pre.fa6e4b9.

Fixes #7769.

Details

290a34d fix(npm-shrinkwrap.json): update lockfile

The lockfile (which becomes npm-shrinkwrap.json in the published package) is out of sync. I just ran npm i with the expected npm version (10) and this is the result.

Surprisingly, this is the root of the bug. The published shrinkwrap file was effectively corrupted, due to a bug in npm v11, and this happened because... ⤵

8a159be ci: downgrade to npm@10 when publishing and updating deps

In #7746 we updated GitHub Actions CI workflows to use node.js 24. Node.js 24 comes bundled with npm 11. This means the next release workflow after this PR started running npm commands with npm 11. This, as well as Renovate itself using npm 11 (inspect the lockfile diff closely) resulted in corrupting the lockfile.

To be more specific, I believe we're running into a variation on npm/cli#8767. But we've also struggled with other npm 11 lockfile bugs recently anyway: netlify/build#6640. We should avoid npm 11 altogether for now.

1088b53 test(e2e): verify npm ci runs successfully in a project depending on netlify-cli

This will prevent reintroducing the conditions to hit this npm cli bug.

Follow-ups

I had #7799 in this PR initially, but I pulled it out to get the fixes above out asap.

---

Co-authored-by: Nathan Houle nathan@nathanhoule.com

[github-actions]

📊 Benchmark results

Comparing with 237c3bc

• Dependency count: 1,044 (no change)
• Package size: 304 MB ⬇️ 0.00% decrease vs. 237c3bc
• Number of ts-expect-error directives: 378 (no change)