From ef3b42b303d6cd5218309dcfa6714f314f085150 Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Fri, 18 Sep 2026 20:32:41 +0100 Subject: [PATCH] fix(ci): drop the redundant version rewrite and its stale comment in the mirror job The mirror-github-packages job explicitly rewrote package.json's version on the checked-out release tag, reasoning that @semantic-release/git was absent so nothing ever committed the version bump back to main. That plugin was re-enabled a day later and the comment was never updated. Confirmed directly against the last two releases: the chore(release) commit each tag points at already carries the bumped package.json version, matching the tag. Dropping the now-redundant rewrite and correcting the comment to describe what actually happens today. --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a3e3642..5aa1a31 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -300,12 +300,11 @@ jobs: - name: Build if: steps.mirrored.outputs.already != 'true' run: pnpm build - - name: Rewrite package name, version, and registry for the GitHub Packages scope - # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. version must be set explicitly too: @semantic-release/npm bumps package.json only in the release job's own ephemeral working copy, and with @semantic-release/git absent (see release.config.ts) nothing ever commits that bump back, so the tree checked out here at the release tag still carries source's committed placeholder version rather than the version the tag actually names. + - name: Rewrite package name and registry for the GitHub Packages scope + # GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. version needs no rewrite: @semantic-release/git commits package.json's bump back to main before @semantic-release/github tags that same commit, so the tree checked out here at the release tag already carries the version the tag names. if: steps.mirrored.outputs.already != 'true' run: | npm pkg set name="${MIRROR_NAME}" - npm pkg set version="${{ steps.tag.outputs.version }}" npm pkg set publishConfig.registry="https://npm.pkg.github.com" npm pkg set publishConfig.provenance=false --json - name: Publish the mirror