Wrong npm version in GitHub actions

[svaraborut]

With the introduction of Trusted Publishers it is now important to use npm >= 11 to avoid errors. Setting up a simple GH action

jobs:
  publish:
    runs-on: ubuntu-latest
    name: Release
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '24'

      - run: npm -v
      - run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

And my release.config.js set like this:

export default {
        // ....
	plugins: [
                // ...
		[
			'@semantic-release/exec',
			{
				prepareCmd: 'npm -v'
			}
		]
	]
}

The logs will show two completely different npm versions 11.12.1 and 10.9.2. Attempting to explicitly set the shell with shell: '/bin/bash' or executing the command bash -c 'npm -v' does not solve the issue. My impression is that exec commands are running outside the execution environment set by the actions/setup-node@v6.

[travi]

we depend directly on the npm cli as a dependency of our npm plugin for this reason. if youre using latest versions of semantic-release and, transitively, our npm plugin. that should handle ensuring that the proper npm version is availble at publish time.

if you are up to date and still seeing problems,

• are you using pnpm to manage your dependencies?
• are you defining semantic-release as a dependency or letting npx install it as part of the execution?

[svaraborut]

Using npm not pnpm. semantic-release is part of the dependencies defined in package.json. My usecase needs the execution of a custom command that has the issues mentioned above.

For now I ended up running a separate Action step after the semantic-release command.

[travi]

i dont understand. why are you running npm through exec rather than through the npm plugin that is already bundled with semantic-release? the npm plugin depends directly on the npm cli as a dependency to ensure a version compatible with trusted publishing is used. this exec plugin does not know about that dependency, so npm -v would likely not match the version used by the npm plugin.