From 6a0046917af8de4914d67fbaa6b27b8b21355ccf Mon Sep 17 00:00:00 2001
From: Alex Verkhovsky <alexey.verkhovsky@gmail.com>
Date: Tue, 10 Mar 2026 04:09:10 -0600
Subject: [PATCH] fix(publish): pin npm for trusted publishing

---
 .github/workflows/publish.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index aac350b4e..cb5927dc5 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -52,6 +52,13 @@ jobs:
           node-version-file: ".nvmrc"
           cache: "npm"
 
+      - name: Ensure trusted publishing toolchain
+        run: |
+          # npm trusted publishing requires Node >= 22.14.0 and npm >= 11.5.1.
+          npm install --global npm@11.6.2
+          echo "Node: $(node --version)"
+          echo "npm: $(npm --version)"
+
       - name: Debug npm auth config surface
         run: |
           USERCONFIG=$(npm config get userconfig)