From 7ec85299bc2a14b0686a6fe03c9eeb58d4c57f1e Mon Sep 17 00:00:00 2001
From: gxkl <gxkl203@gmail.com>
Date: Wed, 15 Jul 2026 15:01:06 +0800
Subject: [PATCH 1/2] ci: use Node.js 24 for OIDC release

The release job set node-version 20 but installed npm@latest (npm 12),
which requires Node.js >= 22.22.2, so `npm install -g npm@latest` failed
with EBADENGINE. Node 20's bundled npm 10 also doesn't support OIDC
trusted publishing (needs >= 11.5.1).

Bump the release job to Node.js 24 and the checkout/setup-node actions
to v5/v6 so npm@latest installs cleanly and supports trusted publishing.
---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 953f3f7..22c8de9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,14 +29,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
-          node-version: 20
+          node-version: 24
           registry-url: 'https://registry.npmjs.org'
 
       # OIDC trusted publishing requires npm >= 11.5.1

From b9c62bd94f185be0f16f7e9f044af429afb2e176 Mon Sep 17 00:00:00 2001
From: gxkl <gxkl203@gmail.com>
Date: Wed, 15 Jul 2026 15:17:25 +0800
Subject: [PATCH 2/2] ci: harden release workflow and expand test matrix

Follow-ups from a pipeline review:

- release: add a concurrency group so two triggered releases can't race,
  without cancelling an in-progress one
- release: skip the version bump on dry_run so a dry run has no side effects
- release: push to HEAD:${{ github.ref_name }} explicitly instead of HEAD
- test: also run Node.js 20 and 22 (kept 14/16/18); the package is released
  on Node 24 but CI only tested up to 18
---
 .github/workflows/nodejs.yml  | 2 +-
 .github/workflows/release.yml | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/nodejs.yml b/.github/workflows/nodejs.yml
index 15eac82..3bcaf3a 100644
--- a/.github/workflows/nodejs.yml
+++ b/.github/workflows/nodejs.yml
@@ -15,7 +15,7 @@ jobs:
     uses: artusjs/github-actions/.github/workflows/node-test.yml@v1
     with:
       os: 'ubuntu-latest, macos-latest, windows-latest'
-      version: '16, 18'
+      version: '16, 18, 20, 22'
 
   # Node.js 14 has no macOS arm64 build (macos-latest is Apple Silicon),
   # so run it on Linux and Windows only.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 22c8de9..637b892 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,6 +27,10 @@ jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
+    # 避免并发触发的两次发布互相踩踏，且不取消进行中的发布
+    concurrency:
+      group: release-${{ github.ref }}
+      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@v5
@@ -56,6 +60,7 @@ jobs:
 
       - name: Version bump
         id: bump
+        if: ${{ github.event.inputs.dry_run != 'true' }}
         run: |
           npm version ${{ github.event.inputs.version_type }} -m "Release v%s"
           echo "tag=v$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
@@ -72,7 +77,7 @@ jobs:
 
       - name: Push commit and tag
         if: ${{ github.event.inputs.dry_run != 'true' }}
-        run: git push origin HEAD --follow-tags
+        run: git push origin HEAD:${{ github.ref_name }} --follow-tags
 
       - name: Create GitHub Release
         if: ${{ github.event.inputs.dry_run != 'true' }}