fix: Improve publish postfix

.changeset/heavy-ads-prove.md

@@ -0,0 +1,7 @@
+---
+"secco": patch
+---
+
+When secco publishes a package to the local Verdaccio registry it's in the format `<pkg-name>@1.0.0-secco-1702997119379` where `1702997119379` is the `Date.now()` timestamp. The postfix got extended by using [`nanoid`](https://github.com/ai/nanoid) to add 4 characters at the end, e.g. `<pkg-name>@1.0.0-secco-1702998721042-9hax`.
+
+The goal of this is to mitigate collisions during publishing when at the same timestamp publishing happens to the instance.

package.json

@@ -63,6 +63,7 @@
     "find-workspaces": "^0.3.0",
     "fs-extra": "^11.2.0",
     "lodash-es": "^4.17.21",
+    "nanoid": "^5.0.4",
     "node-fetch": "^3.3.2",
     "nypm": "^0.3.3",
     "pathe": "^1.1.1",

src/verdaccio/index.ts

@@ -1,5 +1,6 @@
 import type { Server } from 'node:http'
 import { runServer } from 'verdaccio'
+import { customAlphabet } from 'nanoid/non-secure'
 import fs from 'fs-extra'
 import { intersection } from 'lodash-es'
 import { logger } from '../utils/logger'
@@ -8,6 +9,8 @@ import { VERDACCIO_CONFIG } from './verdaccio-config'
 import { publishPackage } from './publish-package'
 import { installPackages } from './install-packages'
 
+const nanoid = customAlphabet('0123456789abcdefghijklmnopqrstuvwxyz', 4)
+
 async function startVerdaccio() {
   let resolved = false
 
@@ -49,7 +52,7 @@ export interface PublishPackagesAndInstallArgs {
 export async function publishPackagesAndInstall({ packageNamesToFilePath, destinationPackages, ignorePackageJsonChanges, packagesToPublish, source }: PublishPackagesAndInstallArgs) {
   await startVerdaccio()
 
-  const versionPostfix = Date.now() + Math.floor(Math.random() * 1000)
+  const versionPostfix = `${Date.now()}-${nanoid()}`
   const newlyPublishedPackageVersions: Record<string, string> = {}
 
   for (const packageName of packagesToPublish) {

src/verdaccio/publish-package.ts

@@ -107,7 +107,7 @@ function createTempNpmRc({ pathToPkg, sourcePath }: CreateTempNpmRcArgs) {
 
 type PublishPackageArgs = Omit<PublishPackagesAndInstallArgs, 'destinationPackages'> & {
   packageName: string
-  versionPostfix: number
+  versionPostfix: string
 }
 
 export async function publishPackage({ packageName, packagesToPublish, packageNamesToFilePath, versionPostfix, source, ignorePackageJsonChanges }: PublishPackageArgs) {