From f5760ebae040d936b0d8b90ee1af8bc4035b74f1 Mon Sep 17 00:00:00 2001
From: Logan Lindquist Land <logan@llbbl.com>
Date: Tue, 28 Jul 2026 09:34:36 -0500
Subject: [PATCH] ci: fix release Pack step writing multi-line output to
 GITHUB_OUTPUT

The v0.1.1 tag was pushed and the release workflow ran, but failed at
the Pack step before npm publish, so nothing was published and 0.1.1
is not burned.

`npm pack --silent` still prints the prepack lifecycle banner to
stdout on the runner, so `tarball="$(npm pack --silent)"` captured a
multi-line string. Writing that to $GITHUB_OUTPUT failed with
"Unable to process file command 'output'", failing the job before
publish.

Fix:
- Build explicitly instead of relying on npm's prepack lifecycle hook.
- Pack with --ignore-scripts so no lifecycle output is produced.
- Derive the tarball filename from package.json instead of parsing
  pack's stdout, and assert the file exists so a future npm naming
  change fails loudly instead of silently.

Refs #7
---
 .github/workflows/release.yml | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d933620..ea41a7f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -144,11 +144,27 @@ jobs:
       # Pack once, then validate and publish that exact file. Packing runs
       # prepack (a clean rebuild), so validating the directory and then
       # publishing it would validate one build and ship a different one.
+      #
+      # The build is explicit and pack runs with --ignore-scripts rather than
+      # letting prepack fire, and the filename is derived from the manifest
+      # rather than read from stdout: `npm pack --silent` still prints the
+      # lifecycle banner, so capturing its output yields a multi-line string
+      # that cannot be written to $GITHUB_OUTPUT.
       - name: Pack
         id: pack
         run: |
           set -euo pipefail
-          tarball="$(npm pack --silent)"
+          pnpm build
+          npm pack --ignore-scripts --silent > /dev/null
+
+          tarball="$(node -p "const p = require('./package.json'); \`\${p.name.replace('@', '').replace('/', '-')}-\${p.version}.tgz\`")"
+
+          if [ ! -f "$tarball" ]; then
+            echo "::error::Expected packed tarball ${tarball} was not produced."
+            ls -1 ./*.tgz || true
+            exit 1
+          fi
+
           echo "tarball=${tarball}" >> "$GITHUB_OUTPUT"
           echo "Packed ${tarball}."