fix(ci): pin npm to a Node-compatible version for publishing

[willwashburn]

The publish job failed with EBADENGINE because npm@latest resolved to npm 12.2.0, which requires a newer Node version than the workflow's pinned 22.14.0.

Pin npm to 11.10.1, which supports Node 22.14.0 and OIDC trusted publishing and includes the dependency-resolution fix from npm/cli#8981. An exact version prevents future npm releases from changing the publish job's engine requirements. Includes the compacted work trajectory.

Failed job: https://github.com/AgentWorkforce/trajectories/actions/runs/36965687439/job/110708930403

Validation:

• Package build passed on the updated PR branch.
• Offline publish dry run passed using npm 11.10.1.
• Confirmed npm 11.10.1's engine range accepts Node 22.14.0.
• Workflow validation passed with actionlint -shellcheck=; full actionlint's 14 shell warnings also exist in the unchanged workflow.
• git diff --check passed.

Live OIDC publishing has not been exercised; it requires GitHub Actions.

---

Note

Low Risk
CI-only change to the global npm version in the publish job; no application runtime or auth logic changes.

Overview
Fixes publish workflow failures caused by npm@latest pulling npm 12.2.0, which does not satisfy the job’s pinned Node 22.14.0 (EBADENGINE).

The Update npm for OIDC support step in publish.yml now installs npm@11.10.1 instead of latest, with a short comment that this version keeps OIDC trusted publishing while staying within the Node engine range. The exact pin avoids future npm releases changing engine requirements mid-publish.

Also adds compacted agent trajectory artifacts (.agentworkforce/trajectories/compacted/fix-publish-npm-engine.*) recording the decision to use 11.10.1 over an earlier 11.6.2 pin.

^{Reviewed by Cursor Bugbot for commit 71a40e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T05:05:39.765683Z	a8d6e7a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 08255375-6689-46da-a299-a020e8456a49

📥 Commits

Reviewing files that changed from the base of the PR and between d08342b and a8d6e7a.

📒 Files selected for processing (3)

• .agentworkforce/trajectories/compacted/fix-publish-npm-engine.json
• .agentworkforce/trajectories/compacted/fix-publish-npm-engine.md
• .github/workflows/publish.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The publish workflow now installs npm 11.6.2 instead of npm@latest. Two trajectory records document the version decision and its stated compatibility rationale.

Changes

Publishing npm version

Layer / File(s)	Summary
Publishing npm pin .github/workflows/publish.yml, .agentworkforce/trajectories/compacted/*	The workflow pins npm to 11.6.2 and adds a comment about OIDC support and Node.js compatibility. The trajectory records document the decision and its rationale.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~7 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to a8d6e

The publishing workflow meets the documented Node, npm, and OIDC requirements, with no material merge-blocking risk identified.

Architecture Summary

Architecture risk: 🔵 Low · up to a8d6e

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .agentworkforce/trajectories/compacted/fix-publish-npm-engine.json: Adds a compacted trajectory record containing one testing decision: pin publishing npm to 11.6.2 because npm 12.2.0 requires Node 22.22.2, while the workflow pins Node 22.14.0; the recorded rationale states npm 11.6.2 supports Node >=22.9.0 and exceeds the OIDC minimum of 11.5.1. The record also includes source and date-range metadata and empty learning, finding, affected-file, and commit lists.
• observed — Modified behavior in .agentworkforce/trajectories/compacted/fix-publish-npm-engine.md: Added a trajectory record listing one session, decision, and event; the default agent; zero files and commits; the npm publishing pin test entry; and no key learnings or findings.
• observed — Modified behavior in .github/workflows/publish.yml: The publish job replaces the unpinned npm@latest installation with pinned npm@11.6.2 and adds a comment about OIDC support and Node.js compatibility.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the workflow change to pin npm to a Node-compatible version for publishing.
Description check	✅ Passed	The description directly explains the npm engine failure, the publishing workflow change, validation results, and added trajectory records. It is related to the changeset, although it contains version…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the publish train
npm stays pinned through sun and rain
Node and OIDC find their place
Two records keep the choice in trace
The bunny hops, the build takes flight}

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>