fix(release): npm publish needs a ./ prefix or npm reads the tarball as a git spec - #53
Merged
Merged
Conversation
…as a git spec
`npm publish npm-dist/*.tgz` passed `npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz`
to npm, which parses any `a/b` argument as a GitHub shorthand rather than a path. It
resolved the tarball filename as a repository and failed:
npm error command git --no-replace-objects ls-remote \
ssh://git@github.com/npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz.git
npm error git@github.com: Permission denied (publickey).
owner=npm-dist, repo=agentrust-io-telemetry-0.1.0-alpha.3.tgz. Nothing to do with
credentials or with trusted publishing, which never got the chance to run.
`./npm-dist/*.tgz` makes it unambiguously a path.
This path had never been exercised. npm carries 0.1.0-alpha.1, published before this
workflow existed, and both release runs since have sat in `waiting` on their deployment
environments rather than reaching the publish step. Approving v0.1.0-alpha.3's
environments today ran it for the first time: publish-pypi succeeded and published
agentrust-telemetry 0.1.0a3, publish-npm failed here, and release-assets skipped because
it needs both.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j
Merged
imran-siddique
added a commit
that referenced
this pull request
Sep 14, 2026
Cuts `0.1.0-alpha.4`, following the file set of the last release commit `db3b785` exactly: the same 39 files, none added and none missed. ## What is actually in this release One fix, #53: `release.yml` passed the built tarball to `npm publish` as `npm-dist/*.tgz`, and npm parses any `a/b` argument as a GitHub shorthand rather than a path, so the npm half of a release could never publish. **No SDK behaviour changes.** The Python and TypeScript packages are identical to `0.1.0-alpha.3` apart from the version string. ## Why 35 files are a substitution and four are not The version string is inside the hashed envelope, so bumping it moves every evidence digest. 35 files are pure substitution, `+40/-40`, with zero lines touching anything but the version. The other four are regenerated from the code rather than edited: | file | change | |---|---| | `compatibility/golden/evidence-chain.json` | regenerated from `EvidenceAccumulator`; digests now `19b8a3bb...` and `7146bc82...` | | `tests/test_trace_adapter.py` | `tool_transcript.hash` moves to `a1361148...` | | `packages/typescript/test/trace-finalizer.test.ts` | the same hash, which is the cross-language agreement | | `CHANGELOG.md` | new section, inserted rather than substituted | That the two SDKs land on the identical digest is verified here rather than assumed: **Python 114 passed with 41 subtests**, including `test_repository_gates` which enforces version consistency across the tree, and **TypeScript 41 pass, 0 fail**. ## Context `agentrust-telemetry 0.1.0a3` published to PyPI today, which activated the pending trusted publisher that was days from expiring. `publish-npm` failed on the defect #53 fixes, and `release-assets` skipped because it needs both. A re-run of that release cannot help: the run is pinned to `db3b785` and a re-run replays the workflow file at that commit, which still has the bug. Hence a fresh tag. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm publish npm-dist/*.tgzhands npmnpm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz, and npm parses anya/bargument as a GitHub shorthand rather than a path. It resolved the tarball's own filename as a repository:owner=npm-dist,repo=agentrust-io-telemetry-0.1.0-alpha.3.tgz. Nothing to do with credentials or with trusted publishing, which never got the chance to run../npm-dist/*.tgzmakes it unambiguously a path.Why this surfaced now
This step had never executed. npm carries
0.1.0-alpha.1, published before this workflow existed, and both release runs since have sat inwaitingon their deployment environments rather than reaching a publish step: run33712267085since 3 September and34270770742since 8 September.Approving
v0.1.0-alpha.3's two environments today ran the publish jobs for the first time.publish-pypisucceeded andagentrust-telemetry 0.1.0a3is now on PyPI, which also activates the pending trusted publisher that was due to expire.publish-npmfailed here.release-assetsskipped, because it needs both, so that release has no attested assets.What this does not fix
release.ymlruns the file at the tag's commit, so this does not republishv0.1.0-alpha.3. The npm package and the release assets for that version stay missing. Exercising the fixed path needs a fresh tag, which is the follow-up.