From 403180b0b310fcddd3e829a46127dd5d8978a840 Mon Sep 17 00:00:00 2001
From: Robin Andeer <robin.andeer@gmail.com>
Date: Mon, 6 Jul 2026 13:39:57 -0400
Subject: [PATCH 1/2] fix: pin allowlisted setup-node SHA for npm publish

Use sdk-node's enterprise-allowed setup-node commit and verify auth with npm whoami before build.
---
 .github/workflows/publish.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d21e95e..b79d805 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -23,10 +23,15 @@ jobs:
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
       - name: Set up Node for npm publish
-        uses: actions/setup-node@499817a2b6e7a2fbd6490d5d6b1c9634a3c6613 # v4.4.0
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 (sdk-node publish)
         with:
-          node-version: '22'
+          node-version: '20'
           registry-url: 'https://registry.npmjs.org'
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Verify npm auth
+        run: npm whoami
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -48,8 +53,6 @@ jobs:
           else
             npm publish --access public
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish react
         working-directory: packages/react
@@ -62,5 +65,3 @@ jobs:
           else
             npm publish --access public
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

From 9b9914139457c408ec0674a6035e85878f06b3aa Mon Sep 17 00:00:00 2001
From: Robin Andeer <robin.andeer@gmail.com>
Date: Mon, 6 Jul 2026 13:52:45 -0400
Subject: [PATCH 2/2] fix: use Node 22 in publish workflow setup-node step

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b79d805..76e93d8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,7 +25,7 @@ jobs:
       - name: Set up Node for npm publish
         uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1 (sdk-node publish)
         with:
-          node-version: '20'
+          node-version: '22'
           registry-url: 'https://registry.npmjs.org'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}