fix(ci): use fleet setup-and-install instead of npm ci in publish workflow - #69
Merged
Merged
Conversation
…kflow The publish workflow ran npm ci, but this repo is pnpm-locked (only pnpm-lock.yaml exists, and devEngines pins pnpm with onFail=error), so the install step fails before any store publish can happen. Replace the setup-node + npm ci pair with the local fleet setup-and-install composite, invoked exactly as ci.yml invokes it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Defect
.github/workflows/publish.ymlrunsnpm ciin a pnpm-locked repo.Failure mode
npm cirequirespackage-lock.json; this repo only haspnpm-lock.yaml, anddevEngines.packageManagerpins pnpm withonFail: "error". The install step fails on every tag push, so the marketplace/OpenVSX publish path never runs as written.Fix
Replace the bare
actions/setup-node+npm cipair with the repo's own fleet composite,./.github/actions/fleet/setup-and-install, invoked exactly as the siblingci.ymlinvokes it (includingsocket-api-token). No workflow step invokesnpm runscripts, so nothing else needed conversion; the publish/release steps already use local composites.Provenance
Found by a fleet-wide code-as-law audit dated 2026-07-28.
Follow-ups deliberately NOT done here
publish-vscode-extensioncomposite still packages vianpx --yes @vscode/vsceinternally (vendored from socket-registry); aligning that with the pnpm posture is upstream re-vendor work.check --all.