ci: use the correct npm version for releases (#11423)

Trusted publishing requires the installed npm to be at least 11.5.1.
We get this automatically via Node 24.

Author: petebacondarwin

.github/workflows/changesets.yml

@@ -27,11 +27,15 @@ jobs:
       - name: Install Dependencies
         uses: ./.github/actions/install-dependencies
         with:
+          node-version: 24
           turbo-api: ${{ secrets.TURBO_API }}
           turbo-team: ${{ secrets.TURBO_TEAM }}
           turbo-token: ${{ secrets.TURBO_TOKEN }}
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
 
+      - name: Check npm version
+        run: node -r esbuild-register tools/deployments/check-npm-version.ts
+
       - name: Check the changesets
         run: node -r esbuild-register tools/deployments/validate-changesets.ts
 

pnpm-lock.yaml

@@ -0,0 +1,20 @@
+import { execSync } from "node:child_process";
+import { compare } from "semver";
+
+/**
+ * For Trusted Publishing to work, we need npm version 11.5.1 or higher.
+ */
+function checkNpmVersion() {
+	const npmVersionBuffer = execSync("npm --version");
+	const npmVersion = npmVersionBuffer.toString().trim();
+	if (compare(npmVersion, "11.5.1") === -1) {
+		console.error(
+			`Error: npm version 11.5.1 or higher is required for Trusted Publishing to work, found version ${npmVersion}`
+		);
+		process.exit(1);
+	}
+}
+
+if (require.main === module) {
+	checkNpmVersion();
+}

tools/deployments/check-npm-version.ts

@@ -14,11 +14,13 @@
 		"@cloudflare/eslint-config-shared": "workspace:*",
 		"@cloudflare/workers-tsconfig": "workspace:*",
 		"@octokit/webhooks-types": "^7.6.1",
+		"@types/semver": "^7.5.1",
 		"@typescript-eslint/eslint-plugin": "catalog:default",
 		"@typescript-eslint/parser": "catalog:default",
 		"eslint": "catalog:default",
 		"find-up": "^6.3.0",
 		"glob": "^11.0.3",
+		"semver": "^7.7.1",
 		"ts-dedent": "^2.2.0",
 		"undici": "catalog:default",
 		"wrangler": "workspace:*"