From a3b09ba97cbc54f833dd2568f4f91e40ed89f6ec Mon Sep 17 00:00:00 2001 From: lzrs Date: Tue, 28 Jul 2026 14:23:32 -0700 Subject: [PATCH] sdg(phase-11): fix the first-release no-op version bump in the Release workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The live no-credential Release run (30397083855) surfaced a latent bug: when the computed release version equals package.json's version — exactly the first-release case — plain 'npm version' fails with 'Version not changed', killing the step before the publish attempt and before the instruction-bearing error message. Add --allow-same-version and group the version bump and publish under one failure handler so any failure in the sequence emits the loud setup instructions. (The retired token workflow carried the same latent bug, masked by its secret guard.) Co-Authored-By: Claude Fable 5 --- .github/workflows/release.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5004fa0..2036300 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -102,8 +102,10 @@ jobs: else echo "No NPM_TOKEN secret — publishing via the OIDC trusted-publishing exchange." fi - npm version "${{ steps.version.outputs.next }}" --no-git-tag-version - if ! npm publish --provenance --access public; then + # --allow-same-version: a first release publishes package.json's own + # version, so the bump is a no-op that plain `npm version` rejects. + if ! { npm version "${{ steps.version.outputs.next }}" --no-git-tag-version --allow-same-version && + npm publish --provenance --access public; }; then echo "::error::Publishing @modularcloud/xspec@${{ steps.version.outputs.next }} failed, so this green main commit was NOT released — see the npm error above. If it is an auth error (E401/E403/E404/ENEEDAUTH), the one-time npm-side setup (specs/DEVOPS.md — npm releases, Credentials) is incomplete: configure the package's Trusted Publisher on npmjs.com (GitHub Actions: owner modularcloud, repository xspec, workflow release.yml) — or, for bootstrap only, set the NPM_TOKEN repository secret. Then re-run this workflow run: it publishes exactly this commit, and duplicate attempts are safe because the registry refuses to republish an existing version." exit 1 fi