fix(ci): make deploy workflows self-bootstrapping#30
Merged
Conversation
Both deploy workflows ran `yarn install --frozen-lockfile` from the workspace root, which tries to resolve every workspace package's dependencies — including the `pg-protocol: npm:@supabase/pg-protocol@ ^X.Y.Z` alias declared in packages/pg/package.json. Any time we bump pg-protocol to a new version, install fails because the new version isn't on npm yet (deploy-pg-protocol.yml is the workflow that's *about to* publish it). The same workflow on the same merge commit fired in parallel for pg and both jobs died at install before they could publish anything. Fix: run install/build/publish strictly inside each package directory. - deploy-pg-protocol.yml: pg-protocol is a leaf TypeScript package with no runtime deps and only TS toolchain devDeps. We can install + build + publish inside packages/pg-protocol/ in full isolation. Use `npm install --workspaces=false --prefix .` so npm doesn't walk up to the workspace root package.json (verified locally — without these flags npm still pulls in the root deps and hits an ESLint peer-dep conflict). - deploy-pg.yml: pg is plain JavaScript — there is no build step (esm/index.mjs is hand-written) and `npm publish` packs straight from the `files` field without resolving any dependencies. So we drop the install step entirely and just `cd packages/pg && npm publish`. Both workflows still trigger on push to master with their existing paths filter; we additionally trigger on changes to the workflow file itself so future workflow tweaks are testable end-to-end without an unrelated source-file change.
soedirgo
approved these changes
May 12, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
After merging #29, both
deploy-pg.ymlanddeploy-pg-protocol.ymlfailed at theInstall dependenciesstep:Root cause (chicken-and-egg)
Both workflows ran
yarn install --frozen-lockfilefrom the workspace root. That triggers resolution for every workspace package — including thepg-protocol: npm:@supabase/pg-protocol@^1.13.0alias declared inpackages/pg/package.json. The latest published@supabase/pg-protocolwas1.8.0, so resolution failed before either workflow could publish anything. The two workflows ran in parallel on the same merge commit and both died at install.This will recur on every future bump of
pg-protocolif not fixed at the workflow level.Fix: scope each workflow to its own package
deploy-pg-protocol.ymlpg-protocolis a leaf TypeScript package — no runtime deps, only TS toolchain devDeps. Install + build + publish runs insidepackages/pg-protocol/only. Usesnpm install --workspaces=false --prefix .sonpmdoes not walk up to the workspace rootpackage.json(verified locally: without the flags, npm pulls in the root devDeps and hits an@typescript-eslint/eslint-pluginpeer conflict).deploy-pg.ymlpgis plain JavaScript — no build step (esm/index.mjsis hand-written).npm publishpacks from thefilesfield without resolving any dependencies. Drop the install step entirely and justcd packages/pg && npm publish.Also extended each workflow's
pathstrigger to include the workflow file itself, so future tweaks are testable without an unrelated source change.Test plan
Verified locally (
packages/pg-protocol):npm install --workspaces=false --prefix . && npm run buildproducesdist/, andnpm publish --dry-runlists the expected 42 files / 36.1 kB tarball.Verified locally (
packages/pg):npm publish --dry-run(no install) lists the expected 21 files / 25.6 kB tarball.After merge: trigger both workflows manually via
workflow_dispatchto publish the still-pending@supabase/pg-protocol@1.13.0and@supabase/pg@8.20.0from the previous merge.