From 8aa8558c2b4dd5d34cf11d0476cfe998ce8e28ef Mon Sep 17 00:00:00 2001 From: Shawn Kuang Date: Mon, 17 Aug 2026 17:06:15 -0700 Subject: [PATCH 1/4] fix: append commit SHA to preview versions to avoid 403 Forbidden ### Description When running `./scripts/publish/run.sh preview ` multiple times, the version generated by `npm version prerelease` was always `X.Y.Z-.0` because the temporary clone checked out by Cloud Build always has the base version in `package.json`, and the bumped version is not pushed back to the branch. Consequently, subsequent publishes of the preview package failed with a `403 Forbidden` error because overwriting an already published package version on the registry is not allowed. This change updates `scripts/publish.sh` to get the latest 6-character commit SHA and append it to the preview version (e.g. `15.27.1-chkuang-connect-to-a1b2c3`), ensuring a unique version for each commit without requiring registry checks. ### Scenarios Tested - Tested version generation in local mock environment. - Verified `npm run lint:changed-files` passes. ### Sample Commands `./scripts/publish/run.sh preview chkuang/connect-to` --- scripts/publish.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/scripts/publish.sh b/scripts/publish.sh index 453c1d86a12..0b1af5d5744 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -95,8 +95,13 @@ echo "Ran tests." if [[ $VERSION == "preview" ]]; then echo "Making a preview version..." sanitized_branch=$(echo "$BRANCH" | sed 's/[^a-zA-Z0-9]/-/g') - npm version prerelease --preid=${sanitized_branch} - NEW_VERSION=$(jq -r ".version" package.json) + npm version prerelease --preid=${sanitized_branch} --no-git-tag-version + INITIAL_VERSION=$(jq -r ".version" package.json) + PREFIX=${INITIAL_VERSION%.*} + COMMIT_SHA=$(git rev-parse --short=6 HEAD) + NEW_VERSION="${PREFIX}-${COMMIT_SHA}" + echo "Setting preview version to ${NEW_VERSION}..." + npm version "${NEW_VERSION}" --no-git-tag-version --allow-same-version echo "Made a preview version." else echo "Making a $VERSION version..." From f83859c938d7ba0ebba305f5b2a58b6ee45415bd Mon Sep 17 00:00:00 2001 From: Shawn Kuang Date: Mon, 17 Aug 2026 17:24:31 -0700 Subject: [PATCH 2/4] refactor: use incremental counter for preview versions ### Description Reverts the preview versioning logic back to using an incremental counter queried from the registry. This is more robust against build retries on the same commit and ensures proper chronological SemVer comparison. ### Scenarios Tested - Tested version logic locally with mock registry outputs. - Verified lint checks pass. ### Sample Commands `./scripts/publish/run.sh preview chkuang/connect-to` --- scripts/publish.sh | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/scripts/publish.sh b/scripts/publish.sh index 0b1af5d5744..b9e5eee9acb 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -98,10 +98,18 @@ if [[ $VERSION == "preview" ]]; then npm version prerelease --preid=${sanitized_branch} --no-git-tag-version INITIAL_VERSION=$(jq -r ".version" package.json) PREFIX=${INITIAL_VERSION%.*} - COMMIT_SHA=$(git rev-parse --short=6 HEAD) - NEW_VERSION="${PREFIX}-${COMMIT_SHA}" - echo "Setting preview version to ${NEW_VERSION}..." - npm version "${NEW_VERSION}" --no-git-tag-version --allow-same-version + echo "Checking registry for existing preview versions with prefix ${PREFIX}..." + MATCHING_VERSIONS=$(npm view firebase-tools versions --registry https://wombat-dressing-room.appspot.com --json | jq -r 'if type == "array" then .[] else . end | select(startswith("'"$PREFIX"'."))' || true) + if [[ -n "$MATCHING_VERSIONS" ]]; then + MAX_SUFFIX=$(echo "$MATCHING_VERSIONS" | sed "s/^${PREFIX}\.//" | sort -n | tail -n 1) + NEXT_SUFFIX=$((MAX_SUFFIX + 1)) + NEW_VERSION="${PREFIX}.${NEXT_SUFFIX}" + echo "Found existing preview versions. Bumping to ${NEW_VERSION}..." + npm version "${NEW_VERSION}" --no-git-tag-version --allow-same-version + else + NEW_VERSION=$INITIAL_VERSION + echo "No existing preview versions found. Using ${NEW_VERSION}." + fi echo "Made a preview version." else echo "Making a $VERSION version..." From c597ee647223d4230e5e7bc2c1cf8761507d53d9 Mon Sep 17 00:00:00 2001 From: Shawn Kuang Date: Mon, 17 Aug 2026 17:29:17 -0700 Subject: [PATCH 3/4] refactor: make preview version suffix extraction more robust ### Description Improves the robustness of the preview build suffix calculation by: 1. Using a safer `sed` expression `s/^.*\.//` to strip the prefix instead of literal regular expression interpolation of `${PREFIX}` (which contains dots). 2. Filtering out any non-numeric suffixes or empty outputs with `grep -E '^[0-9]+$'` to ensure only integer suffixes are considered. 3. Supplying a default fallback value of `0` in case no numeric suffixes are found, preventing syntax errors in the arithmetic expansion. ### Scenarios Tested - Verified version incrementing logic with mock outputs. ### Sample Commands `./scripts/publish/run.sh preview chkuang/connect-to` --- scripts/publish.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/publish.sh b/scripts/publish.sh index b9e5eee9acb..13aaa5fbbe3 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -101,7 +101,8 @@ if [[ $VERSION == "preview" ]]; then echo "Checking registry for existing preview versions with prefix ${PREFIX}..." MATCHING_VERSIONS=$(npm view firebase-tools versions --registry https://wombat-dressing-room.appspot.com --json | jq -r 'if type == "array" then .[] else . end | select(startswith("'"$PREFIX"'."))' || true) if [[ -n "$MATCHING_VERSIONS" ]]; then - MAX_SUFFIX=$(echo "$MATCHING_VERSIONS" | sed "s/^${PREFIX}\.//" | sort -n | tail -n 1) + MAX_SUFFIX=$(echo "$MATCHING_VERSIONS" | sed 's/^.*\.//' | grep -E '^[0-9]+$' | sort -n | tail -n 1) + MAX_SUFFIX=${MAX_SUFFIX:-0} NEXT_SUFFIX=$((MAX_SUFFIX + 1)) NEW_VERSION="${PREFIX}.${NEXT_SUFFIX}" echo "Found existing preview versions. Bumping to ${NEW_VERSION}..." From b448a91cbff9bd4cfeb987e43137e8d4b43672e1 Mon Sep 17 00:00:00 2001 From: Shawn Kuang Date: Tue, 18 Aug 2026 09:01:36 -0700 Subject: [PATCH 4/4] refactor: pass jq variables using --arg instead of shell interpolation ### Description Improves security and robustness of `jq` filtering in the preview version checks by passing `$PREFIX` via `--arg` instead of using single-quoted shell string interpolation. ### Scenarios Tested - Checked linter results. - Tested jq command locally to verify correct filter execution. ### Sample Commands `./scripts/publish/run.sh preview chkuang/connect-to` --- scripts/publish.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/publish.sh b/scripts/publish.sh index 13aaa5fbbe3..efc109dcc1e 100755 --- a/scripts/publish.sh +++ b/scripts/publish.sh @@ -99,7 +99,7 @@ if [[ $VERSION == "preview" ]]; then INITIAL_VERSION=$(jq -r ".version" package.json) PREFIX=${INITIAL_VERSION%.*} echo "Checking registry for existing preview versions with prefix ${PREFIX}..." - MATCHING_VERSIONS=$(npm view firebase-tools versions --registry https://wombat-dressing-room.appspot.com --json | jq -r 'if type == "array" then .[] else . end | select(startswith("'"$PREFIX"'."))' || true) + MATCHING_VERSIONS=$(npm view firebase-tools versions --registry https://wombat-dressing-room.appspot.com --json | jq -r --arg prefix "$PREFIX" 'if type == "array" then .[] else . end | select(startswith($prefix + "."))' || true) if [[ -n "$MATCHING_VERSIONS" ]]; then MAX_SUFFIX=$(echo "$MATCHING_VERSIONS" | sed 's/^.*\.//' | grep -E '^[0-9]+$' | sort -n | tail -n 1) MAX_SUFFIX=${MAX_SUFFIX:-0}