From af0ea9f13c4e3f88272d310caf900ffa0e9b342f Mon Sep 17 00:00:00 2001 From: Masashi Katsumata Date: Mon, 17 Aug 2026 06:22:45 +0900 Subject: [PATCH] =?UTF-8?q?fix(ci):=20npm=20access=20get=20status=20?= =?UTF-8?q?=E3=81=AE=E5=87=BA=E5=8A=9B=E3=82=92=E6=AD=A3=E3=81=97=E3=81=8F?= =?UTF-8?q?=E8=AA=AD=E3=82=80=20/=20=E6=96=B0=E8=A6=8F=E3=83=91=E3=83=83?= =?UTF-8?q?=E3=82=B1=E3=83=BC=E3=82=B8=E5=90=8D=E3=81=AE=E4=BC=9D=E6=92=AD?= =?UTF-8?q?=E3=82=92=E3=83=AA=E3=83=88=E3=83=A9=E3=82=A4=E3=81=99=E3=82=8B?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm access get status ` は ": public" を出すので、行全体を "public" と比較しても一致せず、全パッケージが force 分岐に入って access API から 403 を受けていた（publish 用トークンに access 管理権限は無い）。 実害は無いが本来の結果がノイズに埋もれる。最後のフィールドだけを見る。 匿名 GET は名前が新規のパッケージだと publish 成功後も数分 404 を返す （0.2.0 で react-geojson / react-kml / react-for-mappls が約 5 分 404 だった）。 伝播待ちでリリースを落とさないようリトライする。 ワークフロー冒頭の「まだ publish していない、--dry-run を外せ」というコメントは 既に事実と異なるので実際の手順に書き換えた。 --- .github/workflows/npm-publish.yml | 37 +++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 9 deletions(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index e97a683..14c0a7f 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -1,8 +1,11 @@ -name: npm publish - -# Packages are intentionally not published by this workflow yet. Once the -# generated package contents have been verified, remove --dry-run from the -# publish command and update the workflow name. +name: npm publish + +# Publishes every non-private workspace to npm. RN packages are all +# private: true, so they are excluded by construction. +# +# Order matters: link -> install -> build -> unlink -> assert -> preflight -> +# preview -> publish -> verify. The build must happen while internal deps are +# still linked to "*", and nothing may be published until they are restored. on: workflow_dispatch: @@ -192,19 +195,35 @@ jobs: failed=() for package in "${packages[@]}"; do - status="$(npm access get status "${package}" 2>&1 || echo 'unknown')" + # `npm access get status ` prints ": public", not "public". + # Comparing the whole line to "public" never matched, so every + # package took the "force" branch and got a 403 from the access API + # (the publish token cannot manage access). Harmless, but it buried + # the real result in noise. + status="$(npm access get status "${package}" 2>/dev/null | awk '{print $NF}')" + status="${status:-unknown}" if [ "${status}" != "public" ]; then echo "${package}: access=${status}, forcing public" npm access set status=public "${package}" || echo "::warning::npm access set failed for ${package}" fi # Anonymous, unauthenticated read - what an installing user sees. - code="$(curl -s -o /dev/null -w '%{http_code}' \ - "https://registry.npmjs.org/$(printf '%s' "${package}" | sed 's|/|%2F|')")" + # A brand-new package NAME takes minutes to appear on the read path + # even though publish already returned success (react-geojson, + # react-kml and react-for-mappls all 404'd for ~5 minutes in 0.2.0), + # so retry instead of failing the release on propagation lag. + code=000 + for attempt in $(seq 1 10); do + code="$(curl -s -o /dev/null -w '%{http_code}' \ + "https://registry.npmjs.org/$(printf '%s' "${package}" | sed 's|/|%2F|')")" + [ "${code}" = "200" ] && break + sleep 30 + done + if [ "${code}" = "200" ]; then echo "ok ${package} (anonymous ${code}, access=${status})" else - echo "::error::${package} is not anonymously readable (HTTP ${code}, access=${status})" + echo "::error::${package} is not anonymously readable after retries (HTTP ${code}, access=${status})" failed+=("${package}") fi done