{{ message }}
Repository navigation
ci: remove npm cache from release job - #21
Merged
Merged
Conversation
The Release job's actions/setup-node cache was serving stale registry reads to changesets' publish-idempotency check. When a push doesn't touch the lockfile, the cache key is reused across runs, so a cached "version not yet published" response can survive past the point the version actually gets published, causing changeset publish to retry and npm to reject it as a duplicate. The job installs 484 packages in ~6s uncached, so the cache bought negligible speed for real correctness risk.
ku5ic
added a commit
that referenced
this pull request
Jul 17, 2026
…24) ## Summary - Root cause of today's recurring Release failures ("You cannot publish over the previously published versions: 1.0.5"): npm 12 (installed by the Release job's OIDC npm-upgrade step) changed `npm info --json` to wrap its output in an array. `@changesets/cli@2.31.0`'s `getPackageInfo()` reads `pkgInfo.versions` off the unwrapped result, so under npm 12 it's always `undefined`, and `changeset publish` concludes every already-published package is unpublished, then re-attempts publishing it. npm correctly rejects the duplicate, and Release goes red. - This is a genuine upstream defect, not a misuse on our side: confirmed via `changesets/changesets#2164` (closed), matching our exact symptom and environment (npm 12.0.1, `@changesets/cli@2.31.0`, GitHub Actions). Fixed by `changesets/changesets#2159`, released in `@changesets/cli@2.31.1`. - Bumped the lockfile to `2.31.1` (already permitted by the existing `^2.31.0` range in package.json, no manifest change needed). Verified the array-unwrap fix (`Array.isArray(parsed) ? parsed[0] : parsed`) is present in the installed source. ## Why this wasn't caught by the earlier fixes today - #21 (removing the release job's npm cache) and #22 (the audit-fix PR) both happened to pass Release, but for unrelated reasons: #22's run took `changesets/action`'s "open a Version Packages PR" path (since it carried a pending changeset) rather than the "attempt to publish" path that triggers this bug. The defect was still live underneath. ## Verification - `run-checks.sh`: 4 passed, 0 failed, 0 skipped (typecheck, lint, format, test). ## Sequencing This should merge **before** #23 (the pending Version Packages PR), so the eventual patch-release publish run uses the fixed `@changesets/cli`, and so ordinary future pushes to main don't hit this bug again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/setup-nodenpm cache was serving stale registry reads to changesets' publish-idempotency check.changeset publishread a stale "not yet published" result and retried the publish, which npm then rejected as a duplicate (You cannot publish over the previously published versions: 1.0.5).cache: npmfrom this job's setup-node step eliminates the staleness at the source. Cost: this job installs 484 packages in ~6s uncached, negligible for a job that runs a handful of times a day.Investigation
npm cache is not found(fresh registry reads, published 1.0.5 successfully, then saved the cache). The 18:09 run on aa9088e showedCache hit for: node-cache-Linux-x64-npm-3e33f580...(same key, since aa9088e didn't touch the lockfile) and failed with the duplicate-publish error.npm@latestresolved to 12.0.1 in both runs (12.0.1 was published on npm a week prior, so no version drift occurred between the two runs that same day).Test plan
Version Packagesrelease (with a changeset) still publishes correctly once made.