From a3c998fe0f05148011a7684c9af236bf9860c309 Mon Sep 17 00:00:00 2001 From: Sinan Isik Date: Mon, 19 Oct 2026 12:46:15 +0200 Subject: [PATCH 1/2] =?UTF-8?q?chore:=20adopt=20npm=2012=20=E2=80=94=20pin?= =?UTF-8?q?=2012.1.0=20(INI-249)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin Node 24.21.0 and npm 12.1.0 where semver is installed so dependency install scripts are blocked. --- .github/workflows/test.yml | 12 +++++++++++- Dockerfile | 9 +++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 77d28144..bf987c97 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -211,8 +211,18 @@ jobs: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: '0' + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: "24.21.0" + + # setup-node ships the npm bundled with Node 24 (11.x). npm 12 is the first + # version that blocks dependency install scripts, so pin it before installing. - name: Install Dependencies - run: npm install -g semver + run: | + npm install -g --ignore-scripts npm@12.1.0 + npm --version + npm install -g semver - name: Setup Bats id: setup-bats diff --git a/Dockerfile b/Dockerfile index 0e5cf06f..8d45bc24 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,9 +1,14 @@ -FROM node:20-alpine +FROM node:24.21.0-alpine LABEL "repository"="https://github.com/anothrNick/github-tag-action" LABEL "homepage"="https://github.com/anothrNick/github-tag-action" LABEL "maintainer"="Nick Sjostrom" -RUN apk --no-cache add bash git git-lfs curl jq && npm install -g semver +# node:24.21.0 ships npm 11. npm 12 is the first version that blocks dependency +# install scripts, so pin it before installing semver. +RUN apk --no-cache add bash git git-lfs curl jq \ + && npm install -g --ignore-scripts npm@12.1.0 \ + && npm --version \ + && npm install -g semver COPY entrypoint.sh /entrypoint.sh From 1136be49a998b6ac07b2ebed6e9f03dbafd5e46e Mon Sep 17 00:00:00 2001 From: Sinan Isik Date: Mon, 19 Oct 2026 12:56:16 +0200 Subject: [PATCH 2/2] chore: drop temporary npm version logs (INI-249) CI already printed 12.1.0 for the action image and the bats job. --- .github/workflows/test.yml | 1 - Dockerfile | 1 - 2 files changed, 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index bf987c97..c319b8b0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -221,7 +221,6 @@ jobs: - name: Install Dependencies run: | npm install -g --ignore-scripts npm@12.1.0 - npm --version npm install -g semver - name: Setup Bats diff --git a/Dockerfile b/Dockerfile index 8d45bc24..234630a1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,6 @@ LABEL "maintainer"="Nick Sjostrom" # install scripts, so pin it before installing semver. RUN apk --no-cache add bash git git-lfs curl jq \ && npm install -g --ignore-scripts npm@12.1.0 \ - && npm --version \ && npm install -g semver COPY entrypoint.sh /entrypoint.sh