fix: publish releases even when release PR refresh fails - #39
Merged
Conversation
The sandbox-v0.4.0 release was tagged on GitHub but never published to npm: the release run crashed while refreshing sibling release PR branches (a ref-update race), after createReleases() had tagged the release but before the job emitted its release_created outputs. The re-run then saw the release as already tagged, emitted no outputs, and skipped every publish job — losing the npm publish permanently. Three layers of fix: - cli.ts now emits release outputs immediately after createReleases() and treats the release-PR refresh and check re-runs as non-fatal housekeeping, surfaced as a workflow warning annotation. The next push to main retries the refresh anyway. - The publish jobs' conditions add !cancelled() so outputs written before a job failure still trigger the publishes. - A workflow_dispatch publish-recovery job republishes an already-tagged release whose npm publish never ran (guarded against tag/manifest version mismatch and already-published versions), so this failure mode no longer requires deleting and recreating releases to recover. Change-Id: I669756fe5585d45746fd00e1c6bf0fb86d5b98f2 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Thomas Kosiewski <tk@coder.com>
zizmor flags step-output expansion inside run blocks as template injection; route it through an env var like the other workflows. Change-Id: I7d395ab71db7a75fb7eccb9a191e96e75b32adca Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Thomas Kosiewski <tk@coder.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened to sandbox-v0.4.0
When release PR #34 merged (12:28 UTC today), the release-please run's attempt 1:
sandbox-v0.4.0tag + GitHub release ✅ (12:29:05)autorelease: tagged✅Error updating ref heads/release-please--branches--main--components--providerinsideManifest.createPullRequests()❌emitOutputs()→packages/sandbox--release_createdwas never written → all publish jobs skippedThe manual re-run (attempt 2) saw the release as already tagged, emitted no outputs, and went green without publishing. Result:
sandbox-v0.4.0exists on GitHub but@coder/ai-sdk-sandbox@0.4.0never reached npm. (provider@0.3.1andagent@0.4.1published fine in their own runs.)Fix (three layers)
cli.ts: emit the release outputs immediately aftercreateReleases(), before any release-PR housekeeping. The PR refresh and check re-runs become non-fatal — surfaced as a::warning::annotation; the next push retries them anyway.!cancelled()so outputs written before a later job failure still trigger the publishes.publish-recoveryjob (workflow_dispatch): republishes an already-tagged release whose npm publish never ran. OIDC trusted publishing accepts it because it lives in the same workflow file. Guards: tag must match the checked-outpackage.jsonversion, and the version must not already be on npm.Recovering sandbox-v0.4.0
After this merges:
No need to delete/re-create the tag or GitHub release.
Testing
pnpm check(oxfmt, oxlint, typecheck) andactionlintpass🤖 Generated with Claude Code