ci: pin npm to 11.x and skip an already-published crates.io version - #38
Merged
Conversation
The 5.0.0 release published to crates.io and FAILED on npm. Cause was not the
release trigger: `npm install -g npm@latest` started resolving npm 12, which
requires Node ^22.22.2, while this job sets up Node 20.
npm error code EBADENGINE
npm error Required: {"node":"^22.22.2 || ^24.15.0 || >=26.0.0"}
npm error Actual: {"npm":"10.8.2","node":"v20.20.2"}
An unpinned global upgrade breaks the moment upstream raises its engine floor,
and it took the npm half of a release with it. Pinned to npm@11: 11.6.2
declares ^20.17.0 || >=22.9.0, so it satisfies this runner, and trusted
publishing needs only >= 11.5.1. Raise the pin only together with the Node
version in the Setup node step.
Also guards the crates.io publish against a version already on the index. The
two registries can now diverge -- 5.0.0 is live on crates.io and absent from
npm -- and the only way to retry npm is another release commit, which would
otherwise fail here on "crate version is already uploaded" and hide the npm
result behind a red crates job.
The guard's User-Agent header is required: without it crates.io answers in a
way that reads exactly like "not published", which would silently invert it
into always-publish. Control-tested against the live index -- 5.0.0 matches,
a bogus 9.9.9 does not.
Refs #37
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the npm half of the 5.0.0 release, which failed on
EBADENGINEwhile crates.io succeeded.npm install -g npm@latestnow resolves npm 12, which requires Node^22.22.2; this job sets up Node 20. An unpinned global upgrade breaks the moment upstream raises its engine floor. Pinned tonpm@11— 11.6.2 declares^20.17.0 || >=22.9.0, and trusted publishing needs only >= 11.5.1.Also guards the crates.io step against a version already on the index, because the two registries have now diverged (5.0.0 live on crates.io, absent from npm) and the only retry path is another release commit — which would otherwise go red on
already uploadedand bury the npm result. The guard'sUser-Agentheader is required; without it crates.io answers in a way that reads exactly like "not published", inverting the guard into always-publish. Control-tested against the live index: 5.0.0 matches, a bogus 9.9.9 does not.This commit's subject is deliberately not a bare semver, so merging it publishes nothing. Refs #37.