fix(release): use pnpm 11 native publish for OIDC#107
Merged
Conversation
Request: "Why does publishing cause this error" (changeset publish failing with `EUNKNOWNCONFIG Unknown cli flag: --git-checks`), then "rather use the newer pnpm" to fix it at the root. Motivation: The release job pinned pnpm 10.6.2, whose `pnpm publish` delegates the upload to the npm CLI and forwards its own `--no-git-checks` flag. The workflow also ran `npm install -g npm@latest` for OIDC trusted publishing. On 2026-07-08 npm 12.0.0 shipped, making unknown CLI flags a fatal EUNKNOWNCONFIG instead of a warning, so `--no-git-checks` began breaking the publish (22 prior releases succeeded on npm 11, which only warned). Decisions: - Bump to pnpm 11.12.0 over pinning npm@11: pnpm 11 introduced a native publish flow (no npm delegation) with native OIDC, so --no-git-checks never reaches npm — fixes the root cause instead of masking it. 11.12.0 also includes the 11.1.3 fix for OIDC with the actions/setup-node .npmrc this workflow writes. - Repo-wide bump via packageManager (not release-only): all workflows use unpinned pnpm/action-setup, so packageManager is the single version source; keeps ci/e2e/dev on one pnpm. Confirmed pnpm 11.12.0 accepts the existing lockfile under --frozen-lockfile (875 entries), so no lockfile regen needed. - Move packageExtensions + onlyBuiltDependencies to pnpm-workspace.yaml: pnpm 11 no longer reads the `pnpm` field in package.json; onlyBuiltDependencies gates mongodb-memory-server's postinstall (needed by e2e). - Drop the `npm install -g npm@latest` step entirely: pnpm 11 does OIDC itself. Changes: - .github/workflows/release.yaml: removed the npm upgrade step - package.json: packageManager pnpm@10.6.2 -> pnpm@11.12.0; removed pnpm field - pnpm-workspace.yaml: added packageExtensions and onlyBuiltDependencies Tags: release-workflow, pnpm, pnpm-11, npm, changesets, changeset-publish, oidc-trusted-publishing, git-checks, no-git-checks, eunknownconfig, ci, package-manager, packageextensions, onlybuiltdependencies $15m
Request: "Why is the Docs check workflow failing after you made that PR?" Motivation: After the pnpm 11 bump, CI failed in `pnpm install --frozen-lockfile` (before docs:check) with `ERR_PNPM_IGNORED_BUILDS` (exit 1) for @swc/core, mongodb-memory-server, and sharp. pnpm 11 turns un-reviewed dependency build scripts into a hard error; pnpm 10 only warned, so the 22 prior runs were green. Decisions: - pnpm 11.0.0 REMOVED onlyBuiltDependencies / ignoredBuiltDependencies / neverBuiltDependencies / onlyBuiltDependenciesFile and replaced them with a single `allowBuilds` map (package -> boolean). pnpm still reads the old keys but no longer acts on them (why `pnpm config list` showed the value yet install still failed), so the earlier migration to onlyBuiltDependencies was invalid for pnpm 11. - allowBuilds set to preserve pnpm-10 behavior: mongodb-memory-server: true (needs its postinstall for the mongod binary, used by e2e); @swc/core and sharp: false (both ship prebuilt binaries via optional deps, never built before). Changes: - pnpm-workspace.yaml: replaced onlyBuiltDependencies/ignoredBuiltDependencies with allowBuilds Verified: `pnpm@11.12.0 install --frozen-lockfile` exits 0; mongodb-memory-server postinstall runs, @swc/core and sharp skip without error; lockfile unchanged. Tags: pnpm, pnpm-11, allowbuilds, onlybuiltdependencies, ignoredbuiltdependencies, build-scripts, err-pnpm-ignored-builds, ci, docs-check, mongodb-memory-server, sharp, swc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The release job started failing on
changeset publishwithEUNKNOWNCONFIG Unknown cli flag: --git-checks.Root cause: the repo pinned pnpm 10.6.2, whose
pnpm publishdelegates the upload to thenpmCLI and forwards its own--no-git-checksflag. The workflow also rannpm install -g npm@latestfor OIDC trusted publishing. On 2026-07-08 npm 12.0.0 shipped, which turned unknown CLI flags into a fatalEUNKNOWNCONFIG(npm 11 only warned) — so the forwarded--no-git-checksbegan breaking the publish. 22 prior releases succeeded because they ran on npm 11.Fix: move to pnpm 11, which introduced a native publish flow (no npm delegation) with native OIDC trusted publishing.
--no-git-checksnever reaches npm, and pnpm does the OIDC token exchange itself — so thenpm install -g npm@latestworkaround is removed entirely.Changes
package.json:packageManagerpnpm@10.6.2→pnpm@11.12.0; removed thepnpmfield (pnpm 11 no longer reads it frompackage.json)pnpm-workspace.yaml: movedpackageExtensionsandonlyBuiltDependencieshere (their new home in pnpm 11).github/workflows/release.yaml: removed thenpm install -g npm@lateststepNotes
pnpm/action-setup, sopackageManageris the single version source — this also moves ci/e2e/local dev to pnpm 11.pnpm@11.12.0chosen (latest 11.x): includes the 11.1.3 fix for OIDC alongside theactions/setup-node.npmrcthis workflow writes.Test plan
pnpm 11.12.0 install --frozen-lockfileaccepts the existing committed lockfile (875 entries, passes supply-chain policy) — no lockfile regen needed.install+build+ e2e pass on this branch (exercisesonlyBuiltDependencies→mongodb-memory-serverpostinstall).main→ release job publishes the next version via OIDC without the--git-checkserror.PR Checklist
/r:docs-update- Documentation updated for behavioral changes/r:pr-review- Self-review completed before requesting team review