Repository navigation
fix(publish): assert registry content before publish (#71) - #83
srikolagani wants to merge 2 commits into
Conversation
BichengWang
left a comment
BichengWang
left a comment
There was a problem hiding this comment.
Reviewed d921e17291030c7d19f1d1a36674b5ddfbf1773f. Validation: 17 offline cases using the unchanged guard and publish.mjs on Node 26.10.0, with workspace discovery/install/publish stubbed and real loopback HTTP/tar extraction. No packages were published; CI Node 22 and the full monorepo suite were not run. Requesting changes for the metadata failure path below.
| } catch { | ||
| return null; |
There was a problem hiding this comment.
[P1] Treat only confirmed missing versions as unpublished
This catch returns null for HTTP 500, transport failures, and malformed JSON as well as 404. Lines 106–110 then classify an existing stale package as new, leaving stale empty and exiting successfully.
With unchanged local/registry language dist and a new compiler depending on it through workspace:*, valid mismatched metadata blocks the caller. Changing only the language metadata response to HTTP 500 makes the guard exit 0 and the unmodified publish.mjs reach pnpm -r publish. Curl timeout and malformed JSON also bypass; genuine 404 and matching-content controls pass as expected. If the registry recovers before publishing, the new dependent can be released pinned to the existing stale language version, recreating #71.
Please distinguish confirmed HTTP 404 from other failures and abort on HTTP/transport/parse errors or invalid metadata (including absent dist.tarball). Verified with loopback HTTP and an intercepted publish command; no package was published. The timeout bound was supplied by the test transport, since this curl invocation has none.
This branch has not been deployed
2 participants
Pre-publish registry-content fingerprint so internal to OSS sync cannot reuse a version whose dist drifted; complementary to #72 post-publish import smoke. Not a live latest outage. Fixes #71.