Build/Test Tools: Install the npm version required by `package.json` in GitHub Actions

[manzoorwani.jk]

GitHub Actions uses the npm bundled with Node.js. It satisfies engines.npm only because Node.js 24.18.1 happens to bundle exactly npm 11.16.0, so raising the npm floor above the bundled version would fail every job.

Gutenberg already installs the npm version declared in devEngines.packageManager (​https://github.com/WordPress/gutenberg/pull/82235), as we prepare to move to npm 12 (​https://github.com/WordPress/gutenberg/pull/82732), a security release that makes dependency install scripts and git dependencies opt-in. The Node.js Release WG will not bundle npm 12 with Node.js 22, 24 or 26 (​https://github.com/nodejs/Release/issues/1161#issuecomment-5280655481), so CI has to install it.

Proposal, mirroring ​https://github.com/WordPress/gutenberg/pull/82775 and ​https://github.com/WordPress/gutenberg/pull/82823:

• Add the same devEngines field as Gutenberg to package.json.
• Add a setup-npm action that installs that npm version and owns the npm download cache.
• Disable npm caching in actions/setup-node, which makes it run the bundled npm and fails the devEngines check, if we use the latest npm version.

This keeps Node.js, npm and CI behaviour consistent across both repositories. Release branches that run these workflows from trunk keep their bundled npm.

Adds a setup-npm action, mirroring ​https://github.com/WordPress/gutenberg/pull/82775 and ​https://github.com/WordPress/gutenberg/pull/82823, so CI installs the npm required by devEngines.packageManager even when Node.js bundles an older one. It also adds the same devEngines field as Gutenberg to package.json.

• ​`setup-npm` owns the npm cache, because actions/setup-node resolves it with the bundled npm, which fails with EBADDEVENGINES once a newer npm is required.
• Release branches run these reusable workflows from trunk against their own checkout, which lacks the action. A ​`hashFiles` gate skips it there.
• Release branches lose the npm download cache. They run rarely, and setup-node's exact key rarely hit anyway.
• Callers' paths filters now include .github/actions/setup-npm/**.

cc @desrosj: unrelated, but 6.9's ​`test-build-processes.yml` omits gutenberg-branch, so it builds Gutenberg trunk on Node.js 20 and every Gutenberg job ​fails with `EBADENGINE`. Passing gutenberg-branch: 'wp/6.9', as 6.5 to 6.8 do, should fix it.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: Implementation and this description, reviewed by me.

🤖 Generated with ​Claude Code

I can't request a review, so CCing you all

@desrosj @lancewillett @aduth @ciampo @jsnajdr @tyxla

I would appreciate it if this could be expedited; it will help prepare the repo for npm v12, which we are tracking in ​https://github.com/WordPress/gutenberg/issues/82328

[lancewillett]

In 63782:

Build/Test Tools: Set up the required npm version in CI.

Install npm from the package.json devEngines requirement before resolving dependencies or restoring the npm download cache. Keep CI on the newest compatible release within the required major version.

Scope cache keys to each package and skip the local setup action when a release-branch checkout does not contain it.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13505

Props manzoorwanijk, mciampini, adrianmoldovanwp.
Fixes #66099.

Adds the devEngines block from the root ​package.json to Twenty Twenty-One, Twenty Twenty-Two and Twenty Twenty-Five for consistency with Core. With onFail: "error", npm refuses to install when the Node.js or npm version is below what engines already declares. Versions match trunk (Node.js >=24.18.0, npm >=11.16.0), and the lockfiles are unchanged.

Follow-up to #13505.

Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 5
Used for: Implementation and this description, reviewed by me.

---
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See ​GitHub Pull Requests for Code Review in the Core Handbook for more details.

🤖 Generated with ​Claude Code

CC @lancewillett @adimoldovan @desrosj @johnbillion

[lancewillett]

In 63870:

Bundled Themes: Enforce development tool versions.

Add Core's devEngines configuration to Twenty Twenty-One, Twenty Twenty-Two, and Twenty Twenty-Five. Enforce their existing Node.js and npm minimum versions when installing dependencies or running npm scripts, and let the shared setup-npm action select a compatible npm version for each theme.

Follow-up to [63782].

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/13656

Props manzoorwanijk, lucatume.
See #66099.

https://core.trac.wordpress.org/changeset/63870