Skip to content

fix(ci): drop the redundant version rewrite and its stale comment in the mirror job #46

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mearman merged 1 commit into from
Sep 18, 2026
Merged

fix(ci): drop the redundant version rewrite and its stale comment in the mirror job #46

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,12 +300,11 @@ jobs:
- name: Build
if: steps.mirrored.outputs.already != 'true'
run: pnpm build
- name: Rewrite package name, version, and registry for the GitHub Packages scope
# GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. version must be set explicitly too: @semantic-release/npm bumps package.json only in the release job's own ephemeral working copy, and with @semantic-release/git absent (see release.config.ts) nothing ever commits that bump back, so the tree checked out here at the release tag still carries source's committed placeholder version rather than the version the tag actually names.
- name: Rewrite package name and registry for the GitHub Packages scope
# GitHub Packages requires the npm package name to be scoped to the repo owner. Rewriting the fields rather than keeping a second package.json means the mirror cannot drift from the real package's metadata. publishConfig.registry must be overridden too: it takes precedence over any registry .npmrc sets, so without this the publish silently targets registry.npmjs.org instead — GITHUB_TOKEN is not a credential that registry recognises. provenance must be disabled here specifically: it is inherited from the real package's publishConfig (true, for the npmjs.com OIDC flow), but generating it requires id-token: write, which this job deliberately does not hold, and GitHub Packages has no provenance/OIDC story of its own to generate it against regardless. version needs no rewrite: @semantic-release/git commits package.json's bump back to main before @semantic-release/github tags that same commit, so the tree checked out here at the release tag already carries the version the tag names.
if: steps.mirrored.outputs.already != 'true'
run: |
npm pkg set name="${MIRROR_NAME}"
npm pkg set version="${{ steps.tag.outputs.version }}"
npm pkg set publishConfig.registry="https://npm.pkg.github.com"
npm pkg set publishConfig.provenance=false --json
- name: Publish the mirror
Expand Down
Loading