Skip to content

Fix the npm read-after-write race I introduced in the publish gate #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brentrager merged 1 commit into from
Aug 20, 2026
Merged

Fix the npm read-after-write race I introduced in the publish gate #196

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 21 additions & 6 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,18 +118,33 @@ jobs:
# at 4.5.0 here. Asking each registry directly also makes a re-run heal it.
- name: Which registries are behind package.json?
id: lag
env:
CHANGESETS_PUBLISHED: ${{ steps.changesets.outputs.published }}
run: |
set -euo pipefail
VERSION=$(node -p "require('./package.json').version")
echo "Target version: ${VERSION}"

# npm is the source of truth for "this version is released". The
# Is ${VERSION} actually released? Two independent yeses, because
# neither alone is sufficient:
#
# - changesets published it in THIS run. Authoritative immediately,
# and necessary because npm reads are eventually consistent: a
# `npm view` moments after a successful publish still 404s, which
# skipped all four steps for 4.5.4 and left them a version behind.
# - npm already serves it. This is the backfill path — it lets a
# re-run catch up registries that an earlier run left behind.
#
# Neither true means package.json is bumped but unreleased. The
# changesets action leaves the workspace on the version branch, so in a
# run that only OPENS the version PR, package.json is already bumped to
# a version nothing has published yet — without this gate the four
# steps below would ship it ahead of npm, from an unmerged branch.
if ! npm view "@smooai/logger@${VERSION}" version >/dev/null 2>&1; then
echo "npm does not have ${VERSION} yet — nothing to backfill."
# run that only OPENS the version PR this is exactly the case, and
# publishing here would ship ahead of npm from an unmerged branch.
if [ "${CHANGESETS_PUBLISHED:-false}" = "true" ]; then
echo "changesets published ${VERSION} in this run."
elif npm view "@smooai/logger@${VERSION}" version >/dev/null 2>&1; then
echo "npm already serves ${VERSION} — checking the others for backfill."
else
echo "${VERSION} is not released (not published here, not on npm) — nothing to do."
{
echo "pypi=no"; echo "crates=no"; echo "nuget=no"; echo "gotag=no"
} >> "$GITHUB_OUTPUT"
Expand Down
Loading