From fe5702c67cf2cf38ce957995011c14059e8a179d Mon Sep 17 00:00:00 2001 From: ShaneK Date: Wed, 19 Aug 2026 13:48:15 -0700 Subject: [PATCH 1/2] chore(cd): log npm at verbose so OIDC failures explain themselves The publish now fails with a bare ENEEDAUTH. npm's OIDC helper logs every failure path at verbose, so at the default loglevel there is no way to tell a missing trusted publisher from a permissions problem or a bad id_token: log.verbose('oidc', `Failed token exchange request with body message: ...`) log.verbose('oidc', 'Failed because token exchange was missing the token in the body') log.silly('oidc', 'Skipped because incorrect permissions for id-token ...') Raising the loglevel makes the next run state the reason instead of us inferring it. --- .github/workflows/cd.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 488acba..2cac7af 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -58,4 +58,8 @@ jobs: shell: bash env: NODE_AUTH_TOKEN: '' + # npm logs every OIDC token-exchange failure at verbose, so at the default + # loglevel a missing or mismatched trusted publisher just surfaces as + # ENEEDAUTH with no reason attached. + NPM_CONFIG_LOGLEVEL: verbose From ee162eb8035adacc175f1a5de7c32ec8736d9bd9 Mon Sep 17 00:00:00 2001 From: ShaneK Date: Wed, 19 Aug 2026 14:00:42 -0700 Subject: [PATCH 2/2] fix(cd): fail the publish step when nothing gets published Re-running an old CD run went green having shipped nothing. A workflow re-run checks out the run's original commit, where the manifests still carried the pre-release versions, so `lerna version` declined with an EBEHIND warning and exited 0, and every package then looked already published and was skipped. The publish script now exits non-zero when it publishes no packages, so that state fails loudly instead of reporting success. --- scripts/publish-packages.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/publish-packages.sh b/scripts/publish-packages.sh index 68a44f6..7fedc95 100755 --- a/scripts/publish-packages.sh +++ b/scripts/publish-packages.sh @@ -34,3 +34,16 @@ for manifest in packages/*/package.json; do done echo "published $published package(s)" + +# A run that publishes nothing is a failure, not a success. `lerna version` exits 0 when +# it declines to version (an EBEHIND warning on a stale checkout, for example), which +# leaves the manifests at their released versions and makes every package look already +# published. Without this the job goes green having shipped nothing. +if [ "$published" -eq 0 ]; then + echo "error: no packages were published." >&2 + echo "The manifest versions above are already on the registry, so the Version step" >&2 + echo "did not produce a new release. Check the Version step output rather than" >&2 + echo "re-running this job: re-running a workflow checks out its original commit," >&2 + echo "which still carries the pre-release versions." >&2 + exit 1 +fi