From 93d85f04c3f3431f43f2bd22612ee6aaa7d46b56 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sun, 13 Sep 2026 21:42:02 -0700 Subject: [PATCH] fix(release): npm publish needs a ./ prefix or npm reads the tarball as a git spec `npm publish npm-dist/*.tgz` passed `npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz` to npm, which parses any `a/b` argument as a GitHub shorthand rather than a path. It resolved the tarball filename as a repository and failed: npm error command git --no-replace-objects ls-remote \ ssh://git@github.com/npm-dist/agentrust-io-telemetry-0.1.0-alpha.3.tgz.git npm error git@github.com: Permission denied (publickey). owner=npm-dist, repo=agentrust-io-telemetry-0.1.0-alpha.3.tgz. Nothing to do with credentials or with trusted publishing, which never got the chance to run. `./npm-dist/*.tgz` makes it unambiguously a path. This path had never been exercised. npm carries 0.1.0-alpha.1, published before this workflow existed, and both release runs since have sat in `waiting` on their deployment environments rather than reaching the publish step. Approving v0.1.0-alpha.3's environments today ran it for the first time: publish-pypi succeeded and published agentrust-telemetry 0.1.0a3, publish-npm failed here, and release-assets skipped because it needs both. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_015QRxFm1Z1kE9iraPspwr7j --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 44ec7da..7ec1fd3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -98,7 +98,7 @@ jobs: name: npm-distribution path: npm-dist - name: Publish to npm with trusted publishing - run: npm publish npm-dist/*.tgz --access public --tag "${{ needs.build.outputs.npm_tag }}" + run: npm publish ./npm-dist/*.tgz --access public --tag "${{ needs.build.outputs.npm_tag }}" release-assets: needs: [publish-pypi, publish-npm]