Conversation
`publishPackage` scoped the publish with pnpm's global `--dir` flag. pnpm does
not consume that flag for the `publish` subcommand, so it forwarded both the
directory and the subcommand name into the underlying npm argv:
npm argv "publish" "--ignore-scripts" "proofoftech-breakwater-0.6.0.tgz"
"packages/breakwater" "publish" "--access" "public" "--tag" "latest"
`npm publish` accepts one positional, received three, and exited EUSAGE before
contacting the registry. This code reached main for the first time in the
0.6.0/0.8.0 promotion, so its first execution was also its first failure, and
nothing was published.
Scope the publish by spawn directory instead. `publishInvocation` now owns the
`--dry-run` variant too, so the pre-flight verifies the argv the release path
actually builds rather than one assembled by the caller.
Close the same class elsewhere in the file:
- `ensureTag` prints `New tag: <pkg>@<version>`, which changesets/action greps
out of stdout to decide which tags to push and which releases to create.
Breakwater publishes outside `changeset publish`, so that line is the only
thing that pushes its tag, and drift would be silent: published to npm, never
tagged, exit 0. Pin it against the action's own pattern.
- `command` dropped `spawnSync`'s `error`, so a spawn that never launched
reported `exit signal null` and discarded the cause. Report it honestly.
Both new gates were verified to fail when the defect is reintroduced. The
pre-flight is fully offline: npm pointed at an unroutable registry still exits
0, which is why it needs no credentials, and is also why it cannot cover
authentication, scope permissions, provenance, or version collisions.
ci.yml catches this on the PR that introduces it; release.yml repeats it as a
pre-flight because both workflows start concurrently on a push to main and no
status check is required there, so a red CI cannot block a publish.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The `changeset publish` remainder has no dry-run and is not verified here. Accepted rather than closed: that command was the release workflow's direct `publish:` input before 09a4406 and published from main repeatedly, so only the wrapper around it is new and the wrapper passes it no arguments. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…tion fix: repair the ordered npm publish invocation
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
anchorage-showcase | 62ab23c | Jul 28 2026, 03:39 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 0.6.0/0.8.0 promotion (#42) bumped versions and pushed git tags, but
Releasethen failed and nothing reached npm. #43 fixes the publish invocation. This re-cut letsrelease.ymlpublish the already-versioned packages.Expected result on merge:
@proofoftech/breakwater@0.6.0and@proofoftech/flowsafe@0.8.0published, their git tags pushed, GitHub releases created.What failed
pnpm --dir <dir> publishleaked the directory and subcommand name intonpm publish's argv; npm accepts one positional, got three, exitedEUSAGE. The throw happened beforepublishRemainder, so there is no partial state — re-running publishes the same versions with no version burn.What #43 changed
ensureTag'sNew tag:line against the regexchangesets/actiongreps for. Breakwater now publishes outsidechangeset publish, so that line is the only thing that pushes its tag — drift would have been silent (published, untagged, exit 0).spawnSync'serror, so a spawn that never launched no longer printsexit signal null.pnpm test:release-invocationgate inci.yml, repeated as a pre-flight inrelease.ymlbefore the publish step.verifyis now a required status check onmain, so a red CI can no longer be merged past.Verification
Full gate green on
dev@ 62ab23c via #43: lint, typecheck, test (2200 passed), build, docs:check, docs:check:test, docs:api, release-order, release-invocation, spike:verify.🤖 Generated with Claude Code