Pass the dist-tag to npm publish explicitly - #139
Merged
Conversation
publishConfig.tag is not honoured by every npm version — npm 10.9.4 resolves `latest` regardless, which was caught on the first manual publish: the dry run announced "with tag latest" despite publishConfig.tag being "next". The workflow upgrades npm before publishing so it would probably have been fine, but relying on that is fragile, and the failure mode is silent and public — a prerelease becoming the default install. package.json remains the single source of truth; the new step just reads it so npm cannot fall back. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #138, from something the first manual publish exposed.
release.ymlran a barenpm publishand trustedpublishConfig.tag. That is not honoured by every npm version — on npm 10.9.4 the dry run announced:despite
publishConfig: {access: "public", tag: "next"}, andnpm config get tagconfirms it resolves tolatest. The first publish only landed onnextbecause the tag was passed explicitly on the command line.The workflow does
npm install -g npm@latestbefore publishing, so it may well have behaved correctly — but the failure mode is silent, public and awkward to undo: a prerelease becomes what everyone gets fromnpm install. Worth removing the doubt.package.jsonstays the single source of truth for the dist-tag; the new step just reads it so npm cannot fall back tolatest.Verified the workflow still parses (8 steps) and that the expression resolves to
nextin this checkout.🤖 Generated with Claude Code