Wrong npm version in GitHub actions

[svaraborut]

With the introduction of Trusted Publishers it is now important to use npm >= 11 to avoid errors. Setting up a simple GH action

jobs:
  publish:
    runs-on: ubuntu-latest
    name: Release
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '24'

      - run: npm -v
      - run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

And my release.config.js set like this:

export default {
        // ....
	plugins: [
                // ...
		[
			'@semantic-release/exec',
			{
				prepareCmd: 'npm -v'
			}
		]
	]
}

The logs will show two completely different npm versions 11.12.1 and 10.9.2. Attempting to explicitly set the shell with shell: '/bin/bash' or executing the command bash -c 'npm -v' does not solve the issue. My impression is that exec commands are running outside the execution environment set by the actions/setup-node@v6.

[travi]

we depend directly on the npm cli as a dependency of our npm plugin for this reason. if youre using latest versions of semantic-release and, transitively, our npm plugin. that should handle ensuring that the proper npm version is availble at publish time.

if you are up to date and still seeing problems,

• are you using pnpm to manage your dependencies?
• are you defining semantic-release as a dependency or letting npx install it as part of the execution?