Skip to content

fix(release): verify propagation in rounds instead of per package - #9

Merged
martin-fleck-at merged 1 commit into
mainfrom
issues/7-verify-propagation
Sep 9, 2026
Merged

fix(release): verify propagation in rounds instead of per package#9
martin-fleck-at merged 1 commit into
mainfrom
issues/7-verify-propagation

Conversation

@martin-fleck-at

Copy link
Copy Markdown
Contributor
  • Re-read the dist-tag in rounds over the packages still pending, so waiting on one straggler re-reads the rest for free
  • Budget ten rounds of linear backoff, three minutes in total however many packages lag; per-package it multiplied by the number of stragglers and overran the release job's own timeout
  • Say in the failure that a tag serving the PREVIOUS version is propagation lag rather than a failed publish, and name the re-check
  • Reframe the bootstrap section as adding a package to the published set, since trusted publishing is configured per package and the procedure recurs; drop the two steps that were genuinely one-time
  • Correct that section's instruction to publish with a token from CI: the workflow is OIDC-only and its preflight rejects a token, so a new package's first publish has to be local under npm login
  • Controlled against a fake registry lagging two of ten packages by 30s after their own publish; the previous per-package form reddens on one of them under the same fake

Relates to #7

Release verification
- Re-read the dist-tag in rounds over the packages still pending, so
  waiting on one straggler re-reads the rest for free
- Budget ten rounds of linear backoff, three minutes in total however
  many packages lag; per-package it multiplied by the number of
  stragglers and overran the release job's own timeout
- Say in the failure that a tag serving the PREVIOUS version is
  propagation lag rather than a failed publish, and name the re-check
- Controlled against a fake registry lagging two of ten packages by
  30s after their own publish; the previous per-package form reddens
  on one of them under the same fake

Documentation and comments
- Reframe the bootstrap section as adding a package to the published
  set, since trusted publishing is configured per package and the
  procedure recurs
- Correct its instruction to publish with a token from CI: the
  workflow is OIDC-only and its preflight rejects a token, so a new
  package's first publish has to be local under npm login
- Replace two comments that outlived their facts, the workflow's
  bootstrap justification and a marker tag this repository has never
  carried

Allow CI to be dispatched from the UI, since a branch with no open
pull request matches neither existing trigger.
- Add workflow_dispatch to ci.yml, wired to nothing

Relates to #7
@martin-fleck-at
martin-fleck-at force-pushed the issues/7-verify-propagation branch from e0254a0 to 6ffb517 Compare September 9, 2026 08:58
@martin-fleck-at
martin-fleck-at merged commit ff6cf31 into main Sep 9, 2026
4 checks passed
@martin-fleck-at
martin-fleck-at deleted the issues/7-verify-propagation branch September 9, 2026 09:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant