fix(release): isolate the post-publish verify step from the OIDC npmrc - #230
Merged
Conversation
The v10.0.0-rc.14 run failed at "Verify published packages install as a
single copy each" with the same `Failed to replace env in config:
${NODE_AUTH_TOKEN}` yarn crash that broke rc.12 and rc.13 -- but after
publishing, so all 33 NuGet packages and all five Angular packages were
already out. The casualties were the draft GitHub Release (skipped) and
the single-copy check itself, which never ran.
rc.13's fix moved actions/setup-node's registry-url onto a second call
placed past the last yarn command in the job. This step runs after
publishing, so it sits downstream of that second call, and the .npmrc it
generates stays exported as $NPM_CONFIG_USERCONFIG for every remaining
step. Give the step an empty userconfig of its own -- it installs public
packages from npmjs and authenticates nothing.
Verified by hand against the published set: Yarn Classic resolves exactly
one copy of each of the five @dignite packages, all at 10.0.0-rc.14.
Also documents in resolve-npm-dist-tag.mjs why `next` is left behind while
a pre-release holds `latest`: npm publish takes one --tag, and moving a
second one needs `npm dist-tag add`, which needs a standing credential
OIDC publishing deliberately does not provide.
github-actions
Bot
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
v10.0.0-rc.14release run (33875188525) failed at step 66, "Verify published packages install as a single copy each", with the sameFailed to replace env in config: ${NODE_AUTH_TOKEN}yarn crash that brokev10.0.0-rc.12andv10.0.0-rc.13— five retries, all identical.This time it happened after publishing: "Push tagged release to NuGet.org" and "Publish tagged Angular packages to npm" both succeeded, so rc.14 is fully published on both registries. What the failure cost was the draft GitHub Release (steps 67–68 skipped) and the single-copy check itself, which never actually ran.
Why rc.13's fix didn't cover this
rc.13 moved
actions/setup-node'sregistry-urloff the early Setup Node step onto a secondsetup-nodecall placed after the last yarn command in the job. That fixed every yarn command running before publishing. This step runs after publishing — downstream of that second call — and the.npmrcit generates stays exported as$NPM_CONFIG_USERCONFIGfor the rest of the job. Yarn Classic expands every env-var placeholder in its resolved config on every invocation and throws when one is unset; nothing setsNODE_AUTH_TOKEN, because npm Trusted Publishing doesn't use it.Fix
Run the step with an empty
NPM_CONFIG_USERCONFIGof its own, the same isolation the GitHub Packages step already uses via--userconfig. The step installs published, public packages from npmjs and authenticates nothing, so it needs no registry config at all.Verified by hand against the published set —
node build/verify-npm-single-copy.mjs 10.0.0-rc.14reports Yarn Classic resolving exactly one copy of each of the five@dignitepackages, all at10.0.0-rc.14. So rc.14 itself is sound; only the pipeline was broken.Also
resolve-npm-dist-tag.mjsgains a docstring paragraph explaining whynextis left behind while a pre-release holdslatest(npm publishtakes one--tag, and moving a second needsnpm dist-tag addand a standing credential OIDC publishing deliberately does not provide).nexthas been moved to10.0.0-rc.14by hand for all five packages.