Skip to content

ci: skip @types/node majors, no npm cache in publish job - #52

Merged
aaronjmars merged 1 commit into
mainfrom
ci/dependabot-ignore-publish-cache
Oct 8, 2026
Merged

aaronjmars merged 1 commit into
mainfrom
ci/dependabot-ignore-publish-cache

Conversation

@aaronjmars

Copy link
Copy Markdown
Collaborator

Two small follow-ups from the Dependabot review:

  • .github/dependabot.yml: ignore major updates of @types/node in /ts, so the types stay at the lowest Node line CI tests (engines >=20, CI on Node 22 and 24). This is why chore(deps-dev): bump @types/node from 22.20.1 to 26.6.4 in /ts #50 was closed.
  • release.yml: turn off the setup-node package cache in the npm publish job (OIDC trusted publishing). setup-node recommends no cache in publish workflows, since a poisoned cache could reach the publish credentials. The test jobs keep their cache.

- dependabot: ignore @types/node major updates so types stay at the lowest Node line CI tests (closes the reason for #50).
- release: turn off setup-node package cache in the OIDC npm publish job, as setup-node recommends for publish workflows.
@aaronjmars
aaronjmars merged commit e04b854 into main Oct 8, 2026
5 checks passed
@aaronjmars
aaronjmars deleted the ci/dependabot-ignore-publish-cache branch October 15, 2026 19:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant