From b443d99925f2791d8dcefcfe6323d0b3241f198b Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Sun, 13 Sep 2026 19:07:43 +0530
Subject: [PATCH 1/9] Build/Test Tools: Add a `setup-npm` composite action.

Install the npm version required by `devEngines.packageManager`, keeping the bundled npm when the field is absent. Restore the npm download cache with `actions/cache`, since `actions/setup-node` resolves it with the bundled npm.

Mirrors the Gutenberg action from https://github.com/WordPress/gutenberg/pull/82775 and https://github.com/WordPress/gutenberg/pull/82823.

See #66099.
---
 .github/actions/setup-npm/action.yml | 54 ++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 .github/actions/setup-npm/action.yml

diff --git a/.github/actions/setup-npm/action.yml b/.github/actions/setup-npm/action.yml
new file mode 100644
index 0000000000000..35ae231dcaf18
--- /dev/null
+++ b/.github/actions/setup-npm/action.yml
@@ -0,0 +1,54 @@
+name: 'Set up npm'
+description: 'Installs the npm version required by the devEngines field of package.json, so every job resolves dependencies identically. Keeps the bundled npm when the field is absent.'
+
+inputs:
+  working-directory:
+    description: 'Optional. The directory holding the package.json to read the required npm version from. Defaults to the workspace root.'
+    required: false
+    default: '.'
+  cache:
+    description: 'Optional. Whether to restore and save the npm cache. Defaults to true.'
+    required: false
+    default: 'true'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Install npm
+      id: npm
+      env:
+        WORKING_DIRECTORY: ${{ inputs.working-directory }}
+      run: |
+        NPM_VERSION="$(jq -r '.devEngines.packageManager.version // empty' package.json)"
+        if [ -n "$NPM_VERSION" ]; then
+          # Contributors need the floor; CI stays on that major's newest release.
+          npm install --global "npm@${NPM_VERSION/>=/^}"
+          echo "Required npm version: $NPM_VERSION"
+        else
+          echo "No devEngines.packageManager.version, keeping the bundled npm."
+        fi
+        echo "Installed npm version: $(npm --version)"
+
+        # actions/setup-node cannot restore the npm cache: it locates the
+        # directory with `npm config get cache`, which runs before this step
+        # and fails the devEngines check under the bundled npm.
+        echo "cache-dir=$(npm config get cache | tr -d '\r')" >> "$GITHUB_OUTPUT"
+
+        # Keep the hashFiles patterns workspace-relative and free of a "./"
+        # prefix, so they match the same files as every other cache key.
+        PATH_PREFIX=""
+        if [ "$WORKING_DIRECTORY" != '.' ] && [ -n "$WORKING_DIRECTORY" ]; then
+          PATH_PREFIX="${WORKING_DIRECTORY%/}/"
+        fi
+        echo "path-prefix=$PATH_PREFIX" >> "$GITHUB_OUTPUT"
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+
+    - name: Cache npm downloads
+      if: ${{ inputs.cache == 'true' }}
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ${{ steps.npm.outputs.cache-dir }}
+        key: npm-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles(format('{0}package-lock.json', steps.npm.outputs.path-prefix), format('{0}patches/**', steps.npm.outputs.path-prefix)) }}
+        restore-keys: |
+          npm-cache-${{ runner.os }}-${{ runner.arch }}-

From 796e95eb5ca393722b2fe34a3f7bed598d648b05 Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Sun, 13 Sep 2026 19:07:43 +0530
Subject: [PATCH 2/9] Build/Test Tools: Set up npm in GitHub Actions with the
 `setup-npm` action.

Disable npm caching in `actions/setup-node` and run `setup-npm` before installing dependencies. Skip the action on release branches that run these workflows from `trunk` without it.

Run the calling workflows when the action changes.

See #66099.
---
 .github/workflows/coding-standards.yml                     | 1 +
 .github/workflows/end-to-end-tests.yml                     | 1 +
 .github/workflows/javascript-tests.yml                     | 1 +
 .github/workflows/javascript-type-checking.yml             | 1 +
 .github/workflows/local-docker-environment.yml             | 2 ++
 .github/workflows/performance.yml                          | 1 +
 .github/workflows/phpstan-static-analysis.yml              | 1 +
 .github/workflows/phpunit-tests-full-matrix.yml            | 1 +
 .github/workflows/phpunit-tests.yml                        | 1 +
 .github/workflows/reusable-build-package.yml               | 7 ++++++-
 .github/workflows/reusable-coding-standards-javascript.yml | 7 ++++++-
 .github/workflows/reusable-end-to-end-tests.yml            | 7 ++++++-
 .github/workflows/reusable-javascript-tests.yml            | 7 ++++++-
 .github/workflows/reusable-javascript-type-checking-v1.yml | 7 ++++++-
 .github/workflows/reusable-performance-report-v2.yml       | 2 +-
 .github/workflows/reusable-performance-test-v2.yml         | 7 ++++++-
 .github/workflows/reusable-phpstan-static-analysis-v1.yml  | 7 ++++++-
 .github/workflows/reusable-phpunit-tests-v3.yml            | 7 ++++++-
 .github/workflows/reusable-prepare-gutenberg.yml           | 1 +
 .github/workflows/reusable-test-core-build-process.yml     | 7 ++++++-
 .../reusable-test-local-docker-environment-v1.yml          | 7 ++++++-
 .github/workflows/test-build-processes.yml                 | 1 +
 .github/workflows/test-coverage.yml                        | 2 ++
 23 files changed, 75 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/coding-standards.yml b/.github/workflows/coding-standards.yml
index e1526d54913f3..ad099ad58460a 100644
--- a/.github/workflows/coding-standards.yml
+++ b/.github/workflows/coding-standards.yml
@@ -68,6 +68,7 @@ on:
       - 'composer.*'
       - '**.jshintrc'
       - 'phpcs.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/coding-standards.yml'
       - '.github/workflows/reusable-coding-standards-*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/end-to-end-tests.yml b/.github/workflows/end-to-end-tests.yml
index ca7fb3fae4066..e249f6e25475c 100644
--- a/.github/workflows/end-to-end-tests.yml
+++ b/.github/workflows/end-to-end-tests.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/local-env/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/end-to-end-tests.yml'
       - '.github/workflows/reusable-end-to-end-tests*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/javascript-tests.yml b/.github/workflows/javascript-tests.yml
index 7734f8fd8e98c..97c6f1099a43e 100644
--- a/.github/workflows/javascript-tests.yml
+++ b/.github/workflows/javascript-tests.yml
@@ -69,6 +69,7 @@ on:
       - 'tools/webpack/**'
       - '.jshintrc'
       - 'tests/qunit/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/javascript-tests.yml'
       - '.github/workflows/reusable-javascript-tests.yml'
   workflow_dispatch:
diff --git a/.github/workflows/javascript-type-checking.yml b/.github/workflows/javascript-type-checking.yml
index 65561cabbb1e1..0bf9288b06e82 100644
--- a/.github/workflows/javascript-type-checking.yml
+++ b/.github/workflows/javascript-type-checking.yml
@@ -24,6 +24,7 @@ on:
       # This directory contains TypeScript definitions. Changes could affect the outcome.
       - 'typings/**'
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/javascript-type-checking.yml'
       - '.github/workflows/reusable-javascript-type-checking-v1.yml'
   workflow_dispatch:
diff --git a/.github/workflows/local-docker-environment.yml b/.github/workflows/local-docker-environment.yml
index 894aeeebd779c..c636c695b6d44 100644
--- a/.github/workflows/local-docker-environment.yml
+++ b/.github/workflows/local-docker-environment.yml
@@ -28,6 +28,7 @@ on:
       # These files define the versions to test.
       - '.version-support-*.json'
       # Changes to this and related workflow files should always be verified.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/local-docker-environment.yml'
       - '.github/workflows/reusable-support-json-reader-v1.yml'
       - '.github/workflows/reusable-test-docker-environment-v1.yml'
@@ -55,6 +56,7 @@ on:
       # These files define the versions to test.
       - '.version-support-*.json'
       # Changes to this and related workflow files should always be verified.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/local-docker-environment.yml'
       - '.github/workflows/reusable-support-json-reader-v1.yml'
       - '.github/workflows/reusable-test-docker-environment-v1.yml'
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index c4a3528a552f7..808f299208bc6 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/local-env/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/performance.yml'
       - '.github/workflows/reusable-performance-*.yml'
   workflow_dispatch:
diff --git a/.github/workflows/phpstan-static-analysis.yml b/.github/workflows/phpstan-static-analysis.yml
index 6a26c75b16525..edb7a36c10ffa 100644
--- a/.github/workflows/phpstan-static-analysis.yml
+++ b/.github/workflows/phpstan-static-analysis.yml
@@ -20,6 +20,7 @@ on:
       - 'tests/phpstan/base.neon'
       - 'tests/phpstan/baselines/**'
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpstan-static-analysis.yml'
       - '.github/workflows/reusable-phpstan-static-analysis-v1.yml'
   workflow_dispatch:
diff --git a/.github/workflows/phpunit-tests-full-matrix.yml b/.github/workflows/phpunit-tests-full-matrix.yml
index a6b42f6401174..eedbbdb087e4e 100644
--- a/.github/workflows/phpunit-tests-full-matrix.yml
+++ b/.github/workflows/phpunit-tests-full-matrix.yml
@@ -42,6 +42,7 @@ on:
       - 'tools/vendors/**'
       - 'tools/webpack/**'
       - 'phpunit.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpunit-tests.yml'
       - '.github/workflows/phpunit-tests-full-matrix.yml'
       - '.github/workflows/reusable-phpunit-tests-*.yml'
diff --git a/.github/workflows/phpunit-tests.yml b/.github/workflows/phpunit-tests.yml
index 1e4a22bb61afc..23530363960c4 100644
--- a/.github/workflows/phpunit-tests.yml
+++ b/.github/workflows/phpunit-tests.yml
@@ -46,6 +46,7 @@ on:
       - 'tools/vendors/**'
       - 'tools/webpack/**'
       - 'phpunit.xml.dist'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/phpunit-tests.yml'
       - '.github/workflows/phpunit-tests-full-matrix.yml'
       - '.github/workflows/reusable-phpunit-tests-*.yml'
diff --git a/.github/workflows/reusable-build-package.yml b/.github/workflows/reusable-build-package.yml
index 5005b2149890c..f575cdd10067e 100644
--- a/.github/workflows/reusable-build-package.yml
+++ b/.github/workflows/reusable-build-package.yml
@@ -38,7 +38,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Install npm Dependencies
         run: npm ci
diff --git a/.github/workflows/reusable-coding-standards-javascript.yml b/.github/workflows/reusable-coding-standards-javascript.yml
index 8c0ea06345b85..d55f7ef95f48e 100644
--- a/.github/workflows/reusable-coding-standards-javascript.yml
+++ b/.github/workflows/reusable-coding-standards-javascript.yml
@@ -43,7 +43,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-end-to-end-tests.yml b/.github/workflows/reusable-end-to-end-tests.yml
index 54effadf3d7d4..0c9e772320a1e 100644
--- a/.github/workflows/reusable-end-to-end-tests.yml
+++ b/.github/workflows/reusable-end-to-end-tests.yml
@@ -85,7 +85,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-javascript-tests.yml b/.github/workflows/reusable-javascript-tests.yml
index c0bf656d124bb..661dc1d80dd11 100644
--- a/.github/workflows/reusable-javascript-tests.yml
+++ b/.github/workflows/reusable-javascript-tests.yml
@@ -44,7 +44,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-javascript-type-checking-v1.yml b/.github/workflows/reusable-javascript-type-checking-v1.yml
index 032fa67bf7be8..c148a0512020e 100644
--- a/.github/workflows/reusable-javascript-type-checking-v1.yml
+++ b/.github/workflows/reusable-javascript-type-checking-v1.yml
@@ -42,7 +42,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-performance-report-v2.yml b/.github/workflows/reusable-performance-report-v2.yml
index a2bce3e7c362b..6d6927c32eed0 100644
--- a/.github/workflows/reusable-performance-report-v2.yml
+++ b/.github/workflows/reusable-performance-report-v2.yml
@@ -65,7 +65,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
 
       - name: Download artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
diff --git a/.github/workflows/reusable-performance-test-v2.yml b/.github/workflows/reusable-performance-test-v2.yml
index b92893f52f7f1..6ca40b3a85100 100644
--- a/.github/workflows/reusable-performance-test-v2.yml
+++ b/.github/workflows/reusable-performance-test-v2.yml
@@ -126,7 +126,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Set up PHP
         if: ${{ inputs.subject == 'base' }}
diff --git a/.github/workflows/reusable-phpstan-static-analysis-v1.yml b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
index dba8158c2fc8a..7325d4a25991d 100644
--- a/.github/workflows/reusable-phpstan-static-analysis-v1.yml
+++ b/.github/workflows/reusable-phpstan-static-analysis-v1.yml
@@ -53,7 +53,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Set up PHP
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
diff --git a/.github/workflows/reusable-phpunit-tests-v3.yml b/.github/workflows/reusable-phpunit-tests-v3.yml
index 6348d2a5cfbbf..40c728cb83619 100644
--- a/.github/workflows/reusable-phpunit-tests-v3.yml
+++ b/.github/workflows/reusable-phpunit-tests-v3.yml
@@ -219,7 +219,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       ##
       # This allows Composer dependencies to be installed using a single step.
diff --git a/.github/workflows/reusable-prepare-gutenberg.yml b/.github/workflows/reusable-prepare-gutenberg.yml
index 2d2c407ecdc7a..fd7381550f349 100644
--- a/.github/workflows/reusable-prepare-gutenberg.yml
+++ b/.github/workflows/reusable-prepare-gutenberg.yml
@@ -74,6 +74,7 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
+          package-manager-cache: false
 
       - name: Download and verify Gutenberg build
         id: download
diff --git a/.github/workflows/reusable-test-core-build-process.yml b/.github/workflows/reusable-test-core-build-process.yml
index 1a41257418dec..d333afaccbb39 100644
--- a/.github/workflows/reusable-test-core-build-process.yml
+++ b/.github/workflows/reusable-test-core-build-process.yml
@@ -94,7 +94,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       - name: Log debug information
         run: |
diff --git a/.github/workflows/reusable-test-local-docker-environment-v1.yml b/.github/workflows/reusable-test-local-docker-environment-v1.yml
index 71c8a9a739f66..338ca2e9af54b 100644
--- a/.github/workflows/reusable-test-local-docker-environment-v1.yml
+++ b/.github/workflows/reusable-test-local-docker-environment-v1.yml
@@ -95,7 +95,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: '.nvmrc'
-          cache: npm
+          package-manager-cache: false
+
+      - name: Set up npm
+        # Release branches run this workflow from trunk, but some older branches may lack the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
+        uses: ./.github/actions/setup-npm
 
       ##
       # This allows Composer dependencies to be installed using a single step.
diff --git a/.github/workflows/test-build-processes.yml b/.github/workflows/test-build-processes.yml
index 003fd80d08e08..ed970276e9833 100644
--- a/.github/workflows/test-build-processes.yml
+++ b/.github/workflows/test-build-processes.yml
@@ -43,6 +43,7 @@ on:
       - 'tools/gutenberg/**'
       - 'tools/vendors/**'
       - 'tools/webpack/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-build-processes.yml'
       - '.github/workflows/reusable-test-core-build-process.yml'
   workflow_dispatch:
diff --git a/.github/workflows/test-coverage.yml b/.github/workflows/test-coverage.yml
index 191445ba7167c..c29be2fb4043e 100644
--- a/.github/workflows/test-coverage.yml
+++ b/.github/workflows/test-coverage.yml
@@ -6,6 +6,7 @@ on:
     branches:
       - trunk
     paths:
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-coverage.yml'
       - '.github/workflows/reusable-phpunit-tests-v3.yml'
       - '.github/workflows/reusable-prepare-gutenberg.yml'
@@ -19,6 +20,7 @@ on:
     branches:
       - trunk
     paths:
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/test-coverage.yml'
       - '.github/workflows/reusable-phpunit-tests-v3.yml'
       - '.github/workflows/reusable-prepare-gutenberg.yml'

From 2fa8e3b0d2ad0e93fb89d3c29cc156d18cecf302 Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Sun, 13 Sep 2026 19:07:43 +0530
Subject: [PATCH 3/9] Build/Test Tools: Add `devEngines` to `package.json`.

Declare the same Node.js and npm requirements as Gutenberg, so CI installs the required npm version.

See #66099.
---
 package.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/package.json b/package.json
index ca760568737a3..98ddced8db8ef 100644
--- a/package.json
+++ b/package.json
@@ -14,6 +14,17 @@
 		"node": ">=24.18.0",
 		"npm": ">=11.16.0"
 	},
+	"devEngines": {
+		"runtime": {
+			"name": "node",
+			"version": ">=24.18.0"
+		},
+		"packageManager": {
+			"name": "npm",
+			"version": ">=11.16.0",
+			"onFail": "error"
+		}
+	},
 	"author": "The WordPress Contributors",
 	"license": "GPL-2.0-or-later",
 	"browserslist": [

From 86a1631f5a1175f1a96f44e7ba1af8b77329d3f9 Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Sun, 13 Sep 2026 19:38:46 +0530
Subject: [PATCH 4/9] Test: Require npm 11.19.1 to exercise the installed npm
 in CI.

---
 package-lock.json | 2 +-
 package.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fd069ad47879c..fd0fdce106cf0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -96,7 +96,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.16.0"
+				"npm": ">=11.19.1"
 			}
 		},
 		"node_modules/@asamuzakjp/css-color": {
diff --git a/package.json b/package.json
index 98ddced8db8ef..3a8c0fb58be3e 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
 	},
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.16.0"
+		"npm": ">=11.19.1"
 	},
 	"devEngines": {
 		"runtime": {
@@ -21,7 +21,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.16.0",
+			"version": ">=11.19.1",
 			"onFail": "error"
 		}
 	},

From 41e0ab112c0ad6df8e580ef381ef213f98cf484a Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Sun, 13 Sep 2026 21:24:42 +0530
Subject: [PATCH 5/9] Revert "Test: Require npm 11.19.1 to exercise the
 installed npm in CI."

This reverts commit c0d3c9f696c452469fed38a0657889f854b306aa.
---
 package-lock.json | 2 +-
 package.json      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index fd0fdce106cf0..fd069ad47879c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -96,7 +96,7 @@
 			},
 			"engines": {
 				"node": ">=24.18.0",
-				"npm": ">=11.19.1"
+				"npm": ">=11.16.0"
 			}
 		},
 		"node_modules/@asamuzakjp/css-color": {
diff --git a/package.json b/package.json
index 3a8c0fb58be3e..98ddced8db8ef 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
 	},
 	"engines": {
 		"node": ">=24.18.0",
-		"npm": ">=11.19.1"
+		"npm": ">=11.16.0"
 	},
 	"devEngines": {
 		"runtime": {
@@ -21,7 +21,7 @@
 		},
 		"packageManager": {
 			"name": "npm",
-			"version": ">=11.19.1",
+			"version": ">=11.16.0",
 			"onFail": "error"
 		}
 	},

From d699a1c19e8664aef95ec045da9f410e97a9db42 Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Tue, 15 Sep 2026 17:09:37 +0530
Subject: [PATCH 6/9] Build/Test Tools: Set up npm for default themes with the
 `setup-npm` action.

---
 .../workflows/test-and-zip-default-themes.yml | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-and-zip-default-themes.yml b/.github/workflows/test-and-zip-default-themes.yml
index fc631c5852fef..5d1ccb2ca5e54 100644
--- a/.github/workflows/test-and-zip-default-themes.yml
+++ b/.github/workflows/test-and-zip-default-themes.yml
@@ -10,6 +10,7 @@ on:
       # Changing the preferred version of Node.js could affect themes with build processes.
       - '.npmrc'
       - '.nvmrc'
+      - '.github/actions/setup-npm/**'
       # Changes to any themes with a build script should be confirmed.
       - 'src/wp-content/themes/twentynineteen/**'
       - 'src/wp-content/themes/twentytwenty/**'
@@ -27,6 +28,7 @@ on:
       # Changing the preferred version of Node.js could affect themes with build processes.
       - '.npmrc'
       - '.nvmrc'
+      - '.github/actions/setup-npm/**'
       # Changes to any themes with a build script should be confirmed.
       - 'src/wp-content/themes/twentynineteen/**'
       - 'src/wp-content/themes/twentytwenty/**'
@@ -161,8 +163,12 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: 'src/wp-content/themes/${{ matrix.theme }}/.nvmrc'
-          cache: npm
-          cache-dependency-path: src/wp-content/themes/${{ matrix.theme }}/package-lock.json
+          package-manager-cache: false
+
+      - name: Set up npm
+        uses: ./.github/actions/setup-npm
+        with:
+          working-directory: src/wp-content/themes/${{ matrix.theme }}
 
       - name: Install npm dependencies
         run: npm ci
@@ -246,8 +252,13 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version-file: 'src/wp-content/themes/${{ matrix.theme }}/.nvmrc'
-          cache: npm
-          cache-dependency-path: src/wp-content/themes/${{ matrix.theme }}/package-lock.json
+          package-manager-cache: false
+
+      - name: Set up npm
+        if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'
+        uses: ./.github/actions/setup-npm
+        with:
+          working-directory: src/wp-content/themes/${{ matrix.theme }}
 
       - name: Install npm dependencies
         if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'

From dd526e99d910e1c9be005dfde2d54baf8c90460a Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Wed, 16 Sep 2026 14:58:12 +0530
Subject: [PATCH 7/9] Build/Test Tools: Gate the default theme `setup-npm`
 steps on the action existing.

A `workflow_dispatch` run can check out a release branch, whose tree has
no `.github/actions/setup-npm`, which fails the step with a missing
`action.yml` error.
---
 .github/workflows/test-and-zip-default-themes.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-and-zip-default-themes.yml b/.github/workflows/test-and-zip-default-themes.yml
index 5d1ccb2ca5e54..75de38f8f700b 100644
--- a/.github/workflows/test-and-zip-default-themes.yml
+++ b/.github/workflows/test-and-zip-default-themes.yml
@@ -166,6 +166,8 @@ jobs:
           package-manager-cache: false
 
       - name: Set up npm
+        # A workflow_dispatch run can check out a release branch, which lacks the action.
+        if: ${{ hashFiles('.github/actions/setup-npm/action.yml') != '' }}
         uses: ./.github/actions/setup-npm
         with:
           working-directory: src/wp-content/themes/${{ matrix.theme }}
@@ -255,7 +257,8 @@ jobs:
           package-manager-cache: false
 
       - name: Set up npm
-        if: matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive'
+        # A workflow_dispatch run can check out a release branch, which lacks the action.
+        if: ${{ ( matrix.theme == 'twentytwentytwo' || matrix.theme == 'twentytwentyfive' ) && hashFiles('.github/actions/setup-npm/action.yml') != '' }}
         uses: ./.github/actions/setup-npm
         with:
           working-directory: src/wp-content/themes/${{ matrix.theme }}

From 305712709203ad1e63913e6f9f748c6c8797dd5b Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Wed, 16 Sep 2026 14:58:12 +0530
Subject: [PATCH 8/9] Build/Test Tools: Scope the npm cache key to the package
 directory.

Core and the themes shared the `npm-cache-<os>-<arch>-` restore prefix,
so a theme job restored the core cache and saved a near-copy of it under
its own lockfile hash.
---
 .github/actions/setup-npm/action.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/actions/setup-npm/action.yml b/.github/actions/setup-npm/action.yml
index 35ae231dcaf18..fba5bd0257bcc 100644
--- a/.github/actions/setup-npm/action.yml
+++ b/.github/actions/setup-npm/action.yml
@@ -34,8 +34,9 @@ runs:
         # and fails the devEngines check under the bundled npm.
         echo "cache-dir=$(npm config get cache | tr -d '\r')" >> "$GITHUB_OUTPUT"
 
-        # Keep the hashFiles patterns workspace-relative and free of a "./"
-        # prefix, so they match the same files as every other cache key.
+        # Scopes the cache key to this package and keeps the hashFiles patterns
+        # workspace-relative and free of a "./" prefix, so they match the same
+        # files as every other cache key.
         PATH_PREFIX=""
         if [ "$WORKING_DIRECTORY" != '.' ] && [ -n "$WORKING_DIRECTORY" ]; then
           PATH_PREFIX="${WORKING_DIRECTORY%/}/"
@@ -49,6 +50,6 @@ runs:
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ steps.npm.outputs.cache-dir }}
-        key: npm-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles(format('{0}package-lock.json', steps.npm.outputs.path-prefix), format('{0}patches/**', steps.npm.outputs.path-prefix)) }}
+        key: npm-cache-${{ runner.os }}-${{ runner.arch }}-${{ steps.npm.outputs.path-prefix }}lock-${{ hashFiles(format('{0}package-lock.json', steps.npm.outputs.path-prefix), format('{0}patches/**', steps.npm.outputs.path-prefix)) }}
         restore-keys: |
-          npm-cache-${{ runner.os }}-${{ runner.arch }}-
+          npm-cache-${{ runner.os }}-${{ runner.arch }}-${{ steps.npm.outputs.path-prefix }}lock-

From f20efa86ebc06f3eb913c54a38a2c0dd743ff313 Mon Sep 17 00:00:00 2001
From: Manzoor Wani <manzoorwani.jk@gmail.com>
Date: Thu, 17 Sep 2026 16:29:23 +0530
Subject: [PATCH 9/9] Build/Test Tools: Watch the `setup-npm` action in the
 upgrade testing workflow.

It calls `reusable-build-package.yml`, which now uses the action.
---
 .github/workflows/upgrade-develop-testing.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/upgrade-develop-testing.yml b/.github/workflows/upgrade-develop-testing.yml
index a5474e24620a5..a992ab2925a63 100644
--- a/.github/workflows/upgrade-develop-testing.yml
+++ b/.github/workflows/upgrade-develop-testing.yml
@@ -15,6 +15,7 @@ on:
       - '*.php' # PHP files in the root, like wp-config-sample.php.
       # Confirm any changes to relevant workflow files.
       - '.github/actions/smoke-check/**'
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/upgrade-develop-testing.yml'
       - '.github/workflows/reusable-upgrade-testing.yml'
   pull_request:
@@ -27,6 +28,7 @@ on:
       - 'src/**.php'
       - '*.php' # PHP files in the root, like wp-config-sample.php.
       # Confirm any changes to relevant workflow files.
+      - '.github/actions/setup-npm/**'
       - '.github/workflows/upgrade-develop-testing.yml'
       - '.github/workflows/reusable-upgrade-testing.yml'
   workflow_dispatch: