ci: Use npm registry HTTP API for dist-tag promotion (no-changelog) (#28898)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/scripts/set-latest-for-monorepo-packages.mjs

@@ -1,22 +1,65 @@
-import { trySh } from './github-helpers.mjs';
 import { getMonorepoProjects } from './pnpm-utils.mjs';
 
+const NPM_REGISTRY = 'https://registry.npmjs.org';
+
+/**
+ * @param {string} name
+ * @param {string} version
+ * @param {string} tag
+ * @param {string} token
+ */
+async function setDistTag(name, version, tag, token) {
+	// Scoped package names need the slash encoded (e.g. @n8n/foo → @n8n%2ffoo)
+	const encodedName = name.replace('/', '%2f');
+	const url = `${NPM_REGISTRY}/-/package/${encodedName}/dist-tags/${tag}`;
+
+	return fetch(url, {
+		method: 'PUT',
+		headers: {
+			Authorization: `Bearer ${token}`,
+			'Content-Type': 'application/json',
+		},
+		body: JSON.stringify(version),
+	});
+}
+
 async function setLatestForMonorepoPackages() {
+	const token = process.env.NPM_TOKEN;
+	if (!token) {
+		throw new Error('NPM_TOKEN environment variable is required');
+	}
+
 	const packages = await getMonorepoProjects();
 
 	const publishedPackages = packages //
 		.filter((pkg) => !pkg.private)
 		.filter((pkg) => pkg.version);
 
+	const failures = [];
+
 	for (const pkg of publishedPackages) {
 		const versionName = `${pkg.name}@${pkg.version}`;
-		const res = trySh('npm', ['dist-tag', 'add', versionName, 'latest']);
-		if (res.ok) {
-			console.log(`Set ${versionName} as latest`);
-		} else {
-			console.warn(`Update failed for ${versionName}`);
+
+		try {
+			const res = await setDistTag(pkg.name, pkg.version, 'latest', token);
+
+			if (res.ok) {
+				console.log(`Set ${versionName} as latest`);
+			} else {
+				const body = await res.text().catch(() => '');
+				console.error(`Failed to set ${versionName} as latest: HTTP ${res.status} ${body}`);
+				failures.push(versionName);
+			}
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			console.error(`Failed to set ${versionName} as latest: ${message}`);
+			failures.push(versionName);
 		}
 	}
+
+	if (failures.length > 0) {
+		throw new Error(`Failed to update dist-tags for: ${failures.join(', ')}`);
+	}
 }
 
 // only run when executed directly, not when imported by tests

.github/workflows/release-set-stable-npm-packages-to-latest.yml

@@ -26,12 +26,7 @@ jobs:
           build-command: ''
           install-command: pnpm install --frozen-lockfile --dir ./.github/scripts --ignore-workspace
 
-      # Remove after https://github.com/npm/cli/issues/8547 gets resolved
-      - run: |
-          echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > ~/.npmrc
-          echo "@n8n:registry=https://registry.npmjs.org" >> ~/.npmrc
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-
       - name: Set npm packages to latest
         run: node ./.github/scripts/set-latest-for-monorepo-packages.mjs
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}