fix: setup-node 24, fix repository.url, and bump actions to v6

[decentraland-bot]

Summary

• Add actions/setup-node@v6 with node-version: 24 — Node 24 ships npm 11.x which supports tokenless Trusted Publishing (OIDC) auth. The workflow previously had no setup-node step and relied on the runner default (Node 22 / npm 10.9.8, which does not support OIDC).
• Fix package.json repository field from shorthand "decentraland/protocol.git" to full object format {"type": "git", "url": "git+https://github.com/decentraland/protocol.git"} — npm provenance verification requires repository.url to match the GitHub origin.
• Bump actions/checkout and actions/setup-node from v4 to v6 (node24 runtime, replacing the node20 runtime being phased out).

Root cause

After PR #416 correctly switched to the OIDC-enabled oddish-action and removed NODE_AUTH_TOKEN, the workflow takes the OIDC code path. However, npm publish --provenance failed with ENEEDAUTH because:

1. The runner's default npm 10.x doesn't support the OIDC token exchange for Trusted Publishing
2. The package.json repository field was in shorthand format which may not resolve correctly for provenance verification

Test plan

• Merge this PR and verify the experimental branch publish workflow succeeds
• Confirm node --version shows v24.x and npm --version shows 11.x in workflow logs
• Confirm @dcl/protocol@experimental snapshot is published to npm
• Verify provenance attestation is attached to the published package

🤖 Generated with Claude Code

[github-actions]

Test this pull request on NPM or Yarn

• The @dcl/protocol package can be tested in scenes by running the following NPM command:

  npm install "https://sdk-team-cdn.decentraland.org/@dcl/protocol/branch//dcl-protocol-1.0.0-27167638173.commit-d3552ac.tgz"

• The @dcl/protocol package can be tested in scenes by running the following YARN command:

  yarn add "https://sdk-team-cdn.decentraland.org/@dcl/protocol/branch//dcl-protocol-1.0.0-27167638173.commit-d3552ac.tgz"

[decentraland-bot]

Code Review — PR #417

PR: fix: install npm@11 for Trusted Publishing OIDC auth
Branch: fix/install-npm11-for-trusted-publishing → experimental
Files changed: 2 (+8 −1)
CI: ✅ All checks passing

Summary

Follows up on PR #416 (OIDC migration). The ubuntu-latest runner ships npm 10.9.8, which doesn't support the tokenless OIDC token exchange needed for Trusted Publishing. This PR adds actions/setup-node@v4 with node-version: 24 (ships npm 11.x) to fix the ENEEDAUTH error. Also normalizes the package.json repository field to the standard object format.

Findings

No P0 or P1 issues found. ✅ Recommendation: APPROVE

[P2 — Minor] PR description doesn't match implementation
The PR body says it adds corepack install -g npm@11 && npm --version, but the actual implementation uses actions/setup-node@v4 with node-version: 24. The implementation is actually cleaner and more idiomatic — but the description should be updated for accuracy.

[P2 — Minor] Consider upgrading setup-node to v6
actions/setup-node is now at v6. While v4 works for installing Node 24 (CI confirms this), v4's own node20 runtime is being phased out. Consistent with the existing actions/checkout@v4 — both could be bumped together in a future housekeeping PR.

[P2 — Minor] Tag pinning vs SHA pinning
The new actions/setup-node@v4 uses a tag reference. Consistent with the repo's existing patterns (checkout@v4), but SHA pinning is the org security best practice. Non-blocking — can be addressed in a dedicated pinning sweep.

Pre-existing issues (not blocking this PR)

• steps.myref.outputs.branch at line 51 (check_and_build job) references a step defined in the notify_deployment job (line 81) — the S3 bucket key prefix will have an empty branch segment.
• notify_deployment uses deprecated ::set-output syntax (should migrate to $GITHUB_OUTPUT).
• peter-evans/find-comment@v1 and create-or-update-comment@v1 are significantly outdated.

Security

No security issues found in the changes introduced by this PR. OIDC permissions (id-token: write) were already correctly configured. No secrets added or exposed.

Consumer Impact

No public API surface changes. The package.json repository field is metadata-only and does not affect downstream consumers of @dcl/protocol.

Verdict

✅ APPROVE — No P0 or P1 issues. The change is minimal, correct, and well-targeted. The setup-node approach is cleaner than the corepack alternative mentioned in the description. CI passes.

⚠️ Unable to submit as formal approval because the bot account authored this PR. This review recommends approval.

---

Reviewed by Jarvis 🤖 · Requested by Charly via Slack