From a2912c966955f10534628e0035fe97e3bf863bc9 Mon Sep 17 00:00:00 2001
From: Hayden Bruin <h.bruin@easygo.io>
Date: Tue, 25 Aug 2026 13:24:43 +1000
Subject: [PATCH] fix(ci): give the GitHub Packages mirror its own npmrc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mirror step failed with ENEEDAUTH while the npm publish immediately above
it succeeded. Same root cause as the earlier 401s, third variation:
setup-node's npmrc carries auth for registry.npmjs.org only, so publishing with
--registry=npm.pkg.github.com finds no credential for that host and npm does
not fall back. Appending to the runner's ~/.npmrc does not help either, because
NPM_CONFIG_USERCONFIG points elsewhere.

The step now writes its own npmrc with the GitHub Packages auth line and points
NPM_CONFIG_USERCONFIG at it for that one command.

Also treats "version already published" on the mirror as success. The npm
publish happens first and is irreversible, so a re-run after a mirror failure
would otherwise fail forever on a conflict it cannot clear — the release is
already out on the canonical registry at that point, and the mirror catching up
is the desired outcome.

Confirmed working before this fix: 0.4.0 published to npm ("+ @engineio/ui@0.4.0",
"Published release 0.4.0 on default channel"), tagged, and released. Only the
mirror was broken.
---
 .github/workflows/release.yml | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9972ecd..e9016d3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -160,10 +160,27 @@ jobs:
             echo "no release this run — nothing to mirror"
             exit 0
           fi
+
+          # A DEDICATED npmrc, because setup-node's one only carries auth for
+          # registry.npmjs.org. Publishing with --registry=npm.pkg.github.com
+          # against it fails ENEEDAUTH: npm finds no credential for that host
+          # and does not fall back. NPM_CONFIG_USERCONFIG also means the
+          # runner's ~/.npmrc is ignored, so appending there does nothing.
+          rc=$(mktemp)
+          printf '//npm.pkg.github.com/:_authToken=%s\n' "$NODE_AUTH_TOKEN" > "$rc"
+
           echo "mirroring @engineio/ui@$version to GitHub Packages"
-          npm publish \
-            --registry=https://npm.pkg.github.com \
-            --ignore-scripts \
-            --tag latest
+          # A version already present on the mirror is success, not failure —
+          # it means a previous run got this far. Anything else is a real error.
+          if NPM_CONFIG_USERCONFIG="$rc" npm publish \
+               --registry=https://npm.pkg.github.com \
+               --ignore-scripts --tag latest 2>&1 | tee /tmp/mirror.log; then
+            echo "mirrored"
+          elif grep -qE 'EPUBLISHCONFLICT|cannot publish over|already exists' /tmp/mirror.log; then
+            echo "$version already on GitHub Packages — nothing to do"
+          else
+            echo "::error::mirror to GitHub Packages failed"
+            exit 1
+          fi
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}