Skip to content

Address publish workflow review feedback #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jozefizso merged 1 commit into from
May 2, 2026
Merged

Address publish workflow review feedback #25

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ permissions:
jobs:
publish:
name: publish to npmjs
if: github.event.release.prerelease == false
runs-on: macos-15-intel

steps:
Expand Down Expand Up @@ -63,7 +64,22 @@ jobs:
- name: verify runtime dependency tree
run: npm ls --omit=dev --all

- name: check npm package version
id: npm_version
run: |
package_name="$(node -p "require('./package.json').name")"
package_version="$(node -p "require('./package.json').version")"

if npm view "${package_name}@${package_version}" version --json >/dev/null 2>&1; then
echo "exists=true" >> "$GITHUB_OUTPUT"
else
echo "exists=false" >> "$GITHUB_OUTPUT"
Comment on lines +73 to +76

@chatgpt-codex-connector chatgpt-codex-connector Bot May 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Distinguish npm lookup failures from missing versions

The check npm package version step treats any npm view failure as exists=false, but non-zero exits can also come from transient/auth/registry errors (not only “version does not exist”). In those cases, the workflow will incorrectly proceed as if the version is unpublished, run pack/attest/upload, and then fail at publish (or lose rerun idempotency), which defeats the safety goal introduced by this change. Please only set exists=false for explicit not-found responses and fail the job for other npm view errors.

Useful? React with 👍 / 👎.

fi

echo "package=${package_name}@${package_version}" >> "$GITHUB_OUTPUT"

- name: pack package
if: steps.npm_version.outputs.exists == 'false'
id: pack
run: |
mkdir -p dist
Expand All @@ -73,18 +89,21 @@ jobs:
echo "tarball=$tarball" >> "$GITHUB_OUTPUT"

- name: attest npm package artifact
if: steps.npm_version.outputs.exists == 'false'
uses: actions/attest@v4
with:
subject-path: ${{ steps.pack.outputs.tarball }}

- name: upload npm package artifact
if: steps.npm_version.outputs.exists == 'false'
uses: actions/upload-artifact@v4
with:
name: npm-package
path: ${{ steps.pack.outputs.tarball }}
if-no-files-found: error

- name: publish package
if: steps.npm_version.outputs.exists == 'false'
run: npm publish "$TARBALL" --provenance --access public
env:
TARBALL: ${{ steps.pack.outputs.tarball }}
Expand Down