Publish v4 to npm on a Node that npm supports, and build first - #215
Merged
Conversation
The 4.0.0-alpha.1 publish failed with ENEEDAUTH, and would have published an empty package if it had not. Trusted publishing is configured for this repository and workflow, and the job already requests id-token: write. The credential exchange never happened because the runtime is unsupported: npx -y npm@latest now resolves npm 12, which requires Node ^22.22.2 || ^24.15.0 || >=26, and the job pinned Node 20. npm said so directly before failing. Moving to Node 24 lets the OIDC exchange run. The tarball is the more serious half. v3's package.json carried "prepack": "yarn build", so npm publish built on its way out. The v4 generator emits no prepack, and package.json ships only the dist directory, so the tarball held four files -- LICENSE, README, reference.md and the manifest -- with main pointing at a dist/ that was not in it. The auth failure is the only reason that did not reach npm under a version number that can never be reused. Builds explicitly rather than depending on a lifecycle script the generator no longer writes. The prerelease dist-tag branch is unchanged. Note for v3: main's workflow has the same Node 20 and npx -y npm@latest pairing. It published 3.28.0 only because npm@latest still supported Node 20 then; the next v3 release will fail the same way.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
4.0.0-alpha.1publish failed withENEEDAUTH— and would have published an empty package if it hadn't.Auth: the trust config is fine, the runtime wasn't
Trusted publishing is configured for
getzep/zep-js→npm-publish-cloud.yml, and the job already requestsid-token: write. The exchange never happened because npm refused to run:npx -y npm@latestnow resolves npm 12; the job pinned Node 20. Node 24 lets OIDC run.The tarball is the more serious half
No
dist/. v3'spackage.jsoncarried"prepack": "yarn build", sonpm publishbuilt on its way out. The v4 generator emits no prepack, andfilesships onlydist— somain: ./dist/cjs/index.jspointed at something not in the tarball.The auth failure is the only reason a broken package didn't reach npm under a version number that can never be reused. This builds explicitly instead of depending on a lifecycle script the generator no longer writes.
Unchanged
The prerelease branch still runs
publish --tag preview. The release audit's two requirements on this file both still hold.Follow-up for v3
main's workflow has the samenode-version: '20'+npx -y npm@latestpairing. It published 3.28.0 only because npm@latest still supported Node 20 then — the next v3 release will fail identically. Worth fixing there too, and pinning npm rather than tracking@latest.