[serhalp]

Summary

Requirements are all met, so this should just work:

• ✅ npm 11.5.0+ build: upgrade npm from 10 to 11 #8486
• ✅ node 22.14.0+ feat: update node version to 24 #7746
• ✅ GitHub-hosted runner
• ✅ id-token: write permission in release workflow feat: add npm provenance #5656
• ✅ This workflow configured as a trusted publisher on the npm package

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: d744cfbc-123e-43fd-a9c3-81116f2d8add

Commits

Reviewing files that changed from the base of the PR and between 4c09fe7 and baa7dee.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review.

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Team
• Run ID: 8c8402fd-c518-4fa5-acac-fb99f65f531a

📥 Commits

Reviewing files that changed from the base of the PR and between 6306231 and 4c09fe7.

📒 Files selected for processing: 1

• .github/workflows/release-please.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• netlify/blueprints (manual)

💤 Files with no reviewable changes: 1

• .github/workflows/release-please.yml

Included review availability: This review used your included allowance. 9 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the package publishing workflow. This change affects release operations only; it does not change package features or behavior for end users.

The release workflow no longer sets NODE_AUTH_TOKEN from secrets.NPM_TOKEN in either package publish step. The package preparation step and publish commands remain.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: eduardoboucas

Merge Risk: Minimal · up to 4c09f

No release-workflow defect was established. The publish steps have the visible prerequisites for trusted publishing; confirm both packages’ npm-side publisher settings as part of normal release readiness.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the main change: using npm Trusted Publishing with provenance in CI.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description explains the npm Trusted Publishing requirements targeted by the workflow changes, including npm and Node versions, runner type, permissions, and trusted publisher configuration.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📊 Benchmark results

Comparing with f1632d5

• Dependency count: 968 (no change)
• Package size: 337 MB (no change)
• Number of ts-expect-error directives: 280 (no change)

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/netlify-cli@8658

commit: baa7dee