ci(corepack): pinned the expected dev version of npm and explicitly used it for audit signatures

[travi]

No description provided.

[Tbhesswebber]

Out of curiosity, can someone explain why this was necessary? I'm suddenly getting these errors and I can't figure out if it's a problem with semantic-release tooling, my environment locally and in CI/CD, or something else (maybe ts-api-utils)

[travi]

yep, some context can be found here: #763 (comment)

basically need to update to the latest npm cli to get audit signatures working for provenance on recently published package versions. we chose to use corepack in this case, but other options are available, like simply updating to the latest as a step in the workflow file

[Tbhesswebber]

yep, some context can be found here: #763 (comment)

basically need to update to the latest npm cli to get audit signatures working for provenance on recently published package versions. we chose to use corepack in this case, but other options are available, like simply updating to the latest as a step in the workflow file

Ah, thank you! I don't know why that didn't come up as I was searching.

[github-actions]

🎉 This PR is included in version 12.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀