fix: remove npm check step and specify npm version for OIDC trusted publishing#218
Conversation
yujeong-jeon
changed the title
🔍 No files have been changedLatest commit: cd73ba3 Please check your commit. powered by: naverpay size-action |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — simple and correct fix pinning npm to a specific version instead of latest for reproducible OIDC publishing.
Extended reasoning...
Overview
Single change to : replaces a verbose 'check and upgrade npm' step (which installed ) with a minimal step pinning . Referenced npm/cli#9151 confirms this is a known OIDC trusted publishing compatibility issue.
Security Risks
No security concerns. Pinning to a specific npm version is strictly safer than @latest as it improves reproducibility and avoids supply chain surprises from unexpected version bumps.
Level of Scrutiny
Low scrutiny warranted. This is a CI workflow config tweak — no application logic, no secrets handling changes, and no new permissions added.
Other Factors
No bugs found, no prior reviews, small diff (one file, ~10 lines changed). The change is clearly intentional and well-motivated.
2 participants
…ublishing
Related Issue
Describe your changes
Request