ci: install npm via direct tarball (corepack doesn't replace PATH)

[jim80net]

Summary

Second attempt at fixing the v0.4.0 publish. PR #19 (merged as cf65d33) switched the broken npm install -g npm@latest to corepack prepare [email protected] --activate, but the subsequent manual publish dispatch still failed — with a different error.

Root cause

From run 24176156466:

```
publish > Install a working npm
Preparing [email protected] for immediate activation...
10.9.7 ← npm --version still prints the OLD bundled version

publish > Publish to npm
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@jim80net%2fmemex-core - Not found
```

Corepack's `prepare --activate` stages the package manager in the corepack cache but does not replace the `npm` binary in PATH that the subsequent steps see. `npm --version` printed `10.9.7` — the original broken-bundled version. npm 10.x does not support OIDC trusted publishing (which requires 11.5.1+), so `npm publish` fell back to token auth and hit a 404 against the registry.

Fix

Replace corepack with a direct tarball download. Download `npm-11.6.0.tgz` from registry.npmjs.org, extract over `$NODE_DIR/lib/node_modules/npm`, and `hash -r` to flush the shell's command cache. Hacky but bulletproof — `npm --version` will now report `11.6.0` and OIDC trusted publishing will work.

Recovery plan after merge

Same as before — trigger the publish manually:

```bash
gh workflow run release-please.yml
```

Then verify with `npm view @jim80net/[email protected]`.

🤖 Generated with Claude Code

---

Summary by cubic

Fix release workflow by installing [email protected] from a tarball with integrity verification. Ensures the PATH npm is 11.6.0 so OIDC trusted publishing works.

• Bug Fixes

  • Install [email protected] via tarball over the bundled npm in Node 22.22.2; flush command cache. Avoids token-auth fallback and 404; enables OIDC npm publish.
  • Verify the tarball’s sha512 integrity from the registry before extraction to prevent tampering on a job with id-token: write.

• Migration

  • Run gh workflow run release-please.yml to publish v0.4.0.
  • Verify with npm view @jim80net/[email protected].

^{Written for commit 36d975f. Summary will update on new commits.}

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/release-please.yml">

<violation number="1" location=".github/workflows/release-please.yml:76">
P2: The downloaded npm tarball has no integrity/checksum verification before being installed. This workflow publishes packages with OIDC trusted publishing (`id-token: write`), so a tampered tarball would gain the ability to push arbitrary code to the npm registry. Pin the expected `shasum` (from the registry's `dist.integrity` field) and verify it after download.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}