v0.7.3 #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish to npm | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| registry-url: 'https://registry.npmjs.org' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build all packages | |
| run: pnpm -r run build | |
| # Pre-publish gate: every built bundle must import cleanly. A package | |
| # whose dist throws MODULE_NOT_FOUND (e.g. an un-inlined data file) must | |
| # never reach npm — `pnpm publish` would otherwise print success anyway. | |
| - name: Verify built bundles load | |
| run: pnpm verify:dist | |
| - name: Dry-run publish | |
| run: pnpm -r publish --access public --no-git-checks --dry-run | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| - name: Publish to npm | |
| run: pnpm -r publish --access public --no-git-checks | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| # Fail loudly if the registry doesn't actually have the packages | |
| # we just "published". pnpm has historically printed success for | |
| # scoped publishes that were silently rejected by the registry — | |
| # this step catches that class of bug. | |
| # | |
| # The package list is derived from the workspace (any non-private | |
| # @otaip/* package), not hardcoded. A previously hardcoded list | |
| # silently skipped @otaip/adapter-hotelbeds in v0.6.4: pnpm's | |
| # "+ pkg@version" output looked successful, this step never | |
| # checked hotelbeds, and the registry CDN masked the gap with | |
| # read-side propagation lag long enough to mislead the operator. | |
| # Auto-discovery prevents that recurrence for any new package | |
| # added to the workspace. | |
| - name: Verify packages are live on npm | |
| run: | | |
| set -e | |
| VERSION=$(node -p "require('./package.json').version") | |
| PACKAGES=$(pnpm m ls --json --depth=-1 | node -e " | |
| let s=''; | |
| process.stdin.on('data', c => s += c).on('end', () => { | |
| const arr = JSON.parse(s); | |
| const names = arr | |
| .filter(p => !p.private && p.name && p.name.startsWith('@otaip/')) | |
| .map(p => p.name) | |
| .sort(); | |
| process.stdout.write(names.join(' ')); | |
| }); | |
| ") | |
| if [ -z "$PACKAGES" ]; then | |
| echo "No @otaip/* packages discovered in workspace — refusing to claim success." | |
| exit 1 | |
| fi | |
| echo "Discovered $(echo $PACKAGES | wc -w | tr -d ' ') packages to verify." | |
| # Registry can take up to ~60s to index new publishes. | |
| # Poll each package until it returns 200 or we exceed the budget. | |
| FAIL=0 | |
| for pkg in $PACKAGES; do | |
| printf "%-40s " "$pkg" | |
| SUCCESS=0 | |
| for attempt in 1 2 3 4 5 6; do | |
| CODE=$(curl -s -o /tmp/resp.json -w "%{http_code}" "https://registry.npmjs.org/${pkg}") | |
| if [ "$CODE" = "200" ]; then | |
| LATEST=$(node -e "console.log(require('/tmp/resp.json')['dist-tags']?.latest ?? '')") | |
| if [ "$LATEST" = "$VERSION" ]; then | |
| echo "OK (${LATEST})" | |
| SUCCESS=1 | |
| break | |
| fi | |
| fi | |
| sleep 10 | |
| done | |
| if [ "$SUCCESS" != "1" ]; then | |
| echo "MISSING (expected ${VERSION})" | |
| FAIL=1 | |
| fi | |
| done | |
| if [ "$FAIL" = "1" ]; then | |
| echo "" | |
| echo "One or more packages did not publish. See above." | |
| exit 1 | |
| fi |