From 71b7d27a1e73ecdd9b434b03a43925ac0646b126 Mon Sep 17 00:00:00 2001
From: Nolann Biron <biron.nolann@gmail.com>
Date: Thu, 9 Jul 2026 11:01:12 +0200
Subject: [PATCH] Pin npm to 11.x to fix release publish (sigstore bundling
 bug)

---
 .github/workflows/release.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 303059911..9b8619ce6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -29,9 +29,11 @@ jobs:
                   # npm trusted publishing requires npm 11.5.1+ (Node 22.14.0+)
                   node-version: '24'
                   registry-url: 'https://registry.npmjs.org'
-            # Ensure npm 11.5.1 or later is installed
+            # Ensure npm 11.5.1 or later is installed.
+            # Pinned to the 11.x line: npm 12.0.0 ships without the bundled `sigstore`
+            # module, which breaks provenance publishing (npm/cli#9722).
             - name: Update npm
-              run: npm install -g npm@latest
+              run: npm install -g npm@11
             - name: Setup bun
               uses: oven-sh/setup-bun@v2
               with: