Repository navigation
ci: release skips versions already on npm; npm 11 check survives a published version - #17
Merged
Merged
Conversation
A hand published version (0.1.0) can now get its tag and GitHub release without the tag run failing on "cannot publish over". The check job verifies the tag and looks the version up on npm; the publish job only runs when it is not there. A failed lookup counts as unpublished, so a real publish still fails loudly. id-token: write moves to the publish job, the only one that mints a provenance token.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
npm 11's publish --dry-run refuses a version already on npm ("cannot
publish over the previously published versions"), so after 0.1.0 went
out the packed-install-smoke job failed on every push. npm pkg fix
applies the same package.json corrections without asking the registry:
on a ./ prefixed bin it rewrites the path, and on the current
package.json it changes nothing. The step fails on any rewrite.
Co-Messi
changed the title
0.1.0 was published to npm on 2026-10-09.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
0.1.0 was published to npm by hand, so the repo has no
v0.1.0tag and no GitHub release. Pushing the tag today would runrelease.yml, which would fail trying to publish 0.1.0 again (andNPM_TOKENis not set).Change
release.ymlis split into two jobs:check: verifies the tag matchespackage.json, then looks the version up on npm. If it is already there, it writes a notice and setspublished=true.publish: needscheckand only runs when the version is not on npm. Same steps as before (install, build, check:pack, unit tests, publish with provenance).A failed lookup (network error, missing package) counts as unpublished, so a real publish still runs and fails loudly.
id-token: writemoves from the workflow to the publish job, the only job that mints a provenance token.Also: CI's npm 11 check broke once 0.1.0 was published
The first CI run on this PR failed in
packed-install-smoke: the npm 11publish --dry-runstep from #16 now getsYou cannot publish over the previously published versions: 0.1.0.It would fail on every push until the next version bump. The step now runsnpm pkg fixwith npm 11.6.2 and fails ifpackage.jsonchanges.pkg fixapplies the same corrections publish does, without the registry check. Tested locally: with"./dist/cli/index.js"it rewrites the bin; on the currentpackage.jsonit changes nothing. The CHANGELOG line describing the step is updated to match.Verification
@co-messi/supercut@0.1.0givespublished=true,0.1.1givespublished=false, a missing package givespublished=false.actionlint1.7.12 is clean onrelease.ymlandci.yml.fileslist, so tagging this commit asv0.1.0tags the same package contents that are on npm.release.yml(it triggers onv*tags only). The real check is thev0.1.0tag run after merge:checkgreen,publishskipped.