From 8ea98d176f91545ee5025af9caf6fa21863bc569 Mon Sep 17 00:00:00 2001
From: Ali <268342250+aliengineering-byte@users.noreply.github.com>
Date: Thu, 3 Sep 2026 21:05:53 -0400
Subject: [PATCH] ci: make npm release retry safe

---
 .github/workflows/publish-npm.yml | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 454dba0..0fcb55b 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -3,15 +3,19 @@ name: Publish AgentTX to npm
 on:
   release:
     types: [published]
+  workflow_dispatch:
 
 permissions:
   contents: read
   id-token: write
 
 concurrency:
-  group: npm-agenttx-${{ github.event.release.tag_name }}
+  group: npm-agenttx-${{ github.event_name == 'release' && github.event.release.tag_name || 'v0.3.0' }}
   cancel-in-progress: false
 
+env:
+  RELEASE_TAG: ${{ github.event_name == 'release' && github.event.release.tag_name || 'v0.3.0' }}
+
 jobs:
   verify-and-publish:
     if: github.repository == 'aliengineering-byte/agenttx'
@@ -19,14 +23,14 @@ jobs:
     timeout-minutes: 30
     environment:
       name: npm
-      url: https://www.npmjs.com/package/agenttx/v/${{ github.event.release.tag_name }}
+      url: https://www.npmjs.com/package/agenttx/v/0.3.0
     permissions:
       contents: write
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
-          ref: ${{ github.event.release.tag_name }}
+          ref: ${{ env.RELEASE_TAG }}
           fetch-depth: 0
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
@@ -37,12 +41,11 @@ jobs:
       - run: npm install --global npm@11.9.0
       - name: Validate immutable release identity
         shell: bash
-        env:
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           set -euo pipefail
           test "$(git cat-file -t "refs/tags/$RELEASE_TAG")" = tag
           test "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" = "$(git rev-parse HEAD)"
+          test "$(git rev-parse HEAD)" = "354225e8e5521631c8eb81bef6667aac923cb6d7"
           version="$(node -p "require('./package.json').version")"
           test "$RELEASE_TAG" = "v$version"
           test "$version" = "0.3.0"
@@ -82,17 +85,21 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           set -euo pipefail
           existing="$(gh release view "$RELEASE_TAG" --json assets --jq '.assets[].name')"
+          download="$(mktemp -d)"
           for asset in agenttx-0.3.0.tgz agenttx-0.3.0.sha256; do
             if grep -Fxq "$asset" <<<"$existing"; then
-              echo "Refusing to replace immutable release asset $asset" >&2
-              exit 1
+              gh release download "$RELEASE_TAG" --dir "$download" --pattern "$asset"
+              cmp --silent ".artifacts/$asset" "$download/$asset" || {
+                echo "Existing immutable release asset differs: $asset" >&2
+                exit 1
+              }
+            else
+              gh release upload "$RELEASE_TAG" ".artifacts/$asset"
             fi
           done
-          gh release upload "$RELEASE_TAG" .artifacts/agenttx-0.3.0.tgz .artifacts/agenttx-0.3.0.sha256
       - name: Publish through npm Trusted Publishing
         run: npm publish .artifacts/agenttx-0.3.0.tgz --access public --provenance
       - name: Verify the public package and proof path