fix(ci): release publish never ran; fail closed on an unpublished version - #24
Merged
Conversation
…sion changesets/action executes publish-script as argv without a shell, so 'npm run build && npx changeset publish' ran as 'npm run build' with the trailing tokens swallowed as script arguments. 'changeset publish' never executed, no ndjson was produced, and ignoreReturnCode let the job report success without publishing: main 0.1.1 shipped with no tag, no GitHub release, no npm package. - build in its own step; publish-script is one command now - add a post-release check that the version in package.json exists on the registry, so a silent no-publish fails the job
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The post-merge release workflow on main reported success while publishing nothing: no git tag, no GitHub release, no npm package (
npm view @arcasilesgroup/ai-shell→ 404). Every future release would silently no-op the same way.Cause
changesets/actionexecutespublish-scriptas argv, without a shell. The configurednpm run build && npx changeset publishtherefore ran as:The trailing tokens were swallowed as arguments to the build script (visible in the runner banner:
> pkgroll && npx changeset publish, then ~0.6 s of pkgroll and nothing else).changeset publishnever executed, the ndjson the action reads for tags/releases was never produced — and the action runs scripts withignoreReturnCode: true, so the step, job, and workflow all reported success. Reproduced locally by invoking the exact same argv shape through execa.Fix
publish-script: npx changeset publishis a single command the argv split cannot mangle.package.jsonmust exist on the registry. A green release job that published nothing now fails the job (fail-closed, per the repo's own "each one passes with a command rather than an assertion" rule).Verification
actionlint+prettier --checkon the workflow — green.npm run build "&&" npx changeset publishin a scratch package executes the build script only; publish is never invoked.@arcasilesgroup/ai-shell@0.1.1, create the GitHub release, and publish 0.1.1 to npm via OIDC trusted publishing. If the trusted-publisher registration for this repo +release.yml+ environmentnpmis missing on npmjs.com, the publish step fails loudly (exit 1: "no OIDC tokens found for publishing" / provenance error) — the new registry check proves the outcome either way.