fix: Node.js publish release workflow

[cdunster]

This time it actually does work, I tested it here: https://github.com/holochain/hc-spin/actions/runs/27209734639/job/80335171989

It appears that there was a bug with Trusted Publishers in Node.js v22 (even though the docs claim it should work) after updating to v24 it works.

I also took this oppotunity to disable the caching option (which should be done for release builds) as well as adding NPM_TOKEN back as an optional secret so that this workflow can hopefully be used by projects that are not using Trusted Publishers.

[coderabbitai]

Warning

Review limit reached

@cdunster, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 25 minutes and 1 second. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b6d9517a-ead6-4577-a737-05aa6c19246b

📥 Commits

Reviewing files that changed from the base of the PR and between 7839d8c and 9e0f6e8.

📒 Files selected for processing (1)

• .github/workflows/nodejs-publish-release.yml

Walkthrough

The workflow configuration was updated to support Node.js 24 and improve npm authentication. The default Node version input changed from version 22 to 24. A new optional NPM_TOKEN secret was added to the workflow contract for secure npm package publishing. The actions/setup-node action configuration was modified to disable package-manager caching and instead pass npm authentication via the token secret, replacing the prior cache-based setup.

Suggested reviewers

• ThetaSinner

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: Node.js publish release workflow' directly describes the main change—fixing the Node.js publish release workflow to address a Trusted Publishers bug and workflow improvements.
Description check	✅ Passed	The description is directly related to the changeset, explaining the bug fix for Trusted Publishers in Node.js v22, the upgrade to v24, disabling caching, and reintroducing NPM_TOKEN as an optional secret.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-nodejs-publish

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/nodejs-publish-release.yml (1)

67-72: ⚠️ Potential issue | 🟠 Major

Fix npm authentication in release workflow.

• nodejs-publish-release.yml has no NODE_AUTH_TOKEN anywhere in the workflow, so publishing with a classic NPM_TOKEN will fail; set env: { NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} } on the npm publish step.
• token: ${{ secrets.NPM_TOKEN }} under actions/setup-node won’t provide npm registry auth when registry-url is set; setup-node expects npm auth via NODE_AUTH_TOKEN. Also, actions/setup-node@v4 uses with.cache (not package-manager-cache), so ensure actions/setup-node@v6 supports package-manager-cache before relying on it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/nodejs-publish-release.yml around lines 67 - 72, The
release workflow currently uses actions/setup-node@v6 with registry-url and sets
token under that step, which does not provide npm registry auth; update the npm
publish step to export NODE_AUTH_TOKEN from secrets (set env: { NODE_AUTH_TOKEN:
${{ secrets.NPM_TOKEN }} } on the publish job/step) and remove or stop relying
on token: ${{ secrets.NPM_TOKEN }} under actions/setup-node@v6 for auth; also
verify actions/setup-node@v6 supports the package-manager-cache input — if not,
switch to the supported input name (with.cache) or remove the unsupported
package-manager-cache setting to avoid misconfiguration.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/nodejs-publish-release.yml:
- Around line 67-72: The release workflow currently uses actions/setup-node@v6
with registry-url and sets token under that step, which does not provide npm
registry auth; update the npm publish step to export NODE_AUTH_TOKEN from
secrets (set env: { NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} } on the publish
job/step) and remove or stop relying on token: ${{ secrets.NPM_TOKEN }} under
actions/setup-node@v6 for auth; also verify actions/setup-node@v6 supports the
package-manager-cache input — if not, switch to the supported input name
(with.cache) or remove the unsupported package-manager-cache setting to avoid
misconfiguration.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b3234a73-d292-425a-aedf-065c7e37fc8d

📥 Commits

Reviewing files that changed from the base of the PR and between 39965a6 and 7839d8c.

📒 Files selected for processing (1)

• .github/workflows/nodejs-publish-release.yml

[cocogitto-bot]

✔️ 31a8e9a...9e0f6e8 - Conventional commits check succeeded.