ci(release): publish through the npm CLI, not pnpm - #45
Conversation
The registry's readme field is populated from the publish request and pnpm 11 does not send it: every @BYMAX-ONE package released under pnpm 11 landed with an empty readme and no _npmVersion, while every one released under pnpm 10 — which delegated to the npm CLI — carries both. Confirmed on nest-realtime, where 1.0.1 changed only the command and restored both fields. This repository is still on pnpm 10, so nothing is broken yet. The first release after a pnpm 11 bump would ship with no documentation on the npm page, and Dependabot proposes that bump on its own schedule. --no-git-checks was a pnpm flag; npm runs no git checks, so the detached HEAD at the tag SHA needs nothing of its own.
There was a problem hiding this comment.
Pull request overview
Updates the tag-driven release workflow to publish via the npm CLI instead of pnpm publish, to avoid npm registry metadata regressions (notably missing readme) observed when publishing under pnpm 11—while keeping the existing OIDC trusted publishing flow.
Changes:
- Switch release publishing command from
pnpm publishtonpm publish --provenance --access public. - Expand inline workflow documentation explaining why npm CLI is used (readme field population) and why no git-check flag is needed.
npm runs prepublishOnly on publish and this job already runs it as its own step, so it executes twice. The second run starts with clean, deleting and rebuilding the dist/ that size and check:exports had just validated — the tarball shipped is not the artifact the gates checked. Observed in the nest-realtime 1.0.1 release log. --ignore-scripts packs what is already on disk and verified. The duplication predates the switch to npm publish: pnpm publish ran prepublishOnly the same way.
|
Pushed 49dbed0 — a finding the review raised on the sibling PRs, confirmed in the
|
The workflow publishes through npm now, but the package script still ran pnpm publish — and that script is exactly what a manual publish uses, which is how every first release here happens. It would reproduce the empty registry readme under pnpm 11. No --ignore-scripts here, unlike CI: a manual publish has no preceding gate step, so prepublishOnly running is the point.
Preventive: this library's README is on npm today only because it still publishes under pnpm 10.
The registry's
readmefield is populated from the publish request, and pnpm 11 does not send it. Across the five published@bymax-one/*libraries the split is exact — every package released under pnpm 11 landed with an emptyreadmeand no_npmVersion, every one released under pnpm 10 (which delegated to the npm CLI) carries both.nest-realtime@1.0.1confirmed it by changing only the publish command and restoring both fields in one release;nest-queue@1.0.6is doing the same for the one that regressed.This repository is on pnpm 10, so nothing is broken yet. But the workflow still calls
pnpm publish, so the first release after a pnpm 11 bump would silently ship with no documentation on the npm page — and Dependabot proposes that bump on its own schedule.release.ymlnow callsnpm publish --provenance --access public. The--no-git-checksflag was pnpm's; npm runs no git checks, so the detached HEAD the runner sits on at the tag SHA needs nothing of its own.No version bump. The published metadata for this package is already correct, and
.github/is outsidepackage.json→files, sodist/and the tarball are untouched. Verified: nothing this PR changes is infiles.Correction to the "no version bump" note above. It said the tarball is untouched. That was true when the PR only changed
.github/, but the branch now also alignspackage.json→scripts.releasewith the CI command (that script is how a manual publish runs, and it would have reproduced the empty registryreadmeunder pnpm 11).package.jsondoes ship, and npm keepsscriptsin the published manifest — confirmed:npm view @bymax-one/nest-cache@1.0.3 scripts.releasereturnspnpm publish --provenance. So the tarball will differ by that one informational field.It still does not warrant a release of its own: no consumer resolves or executes a dependency's
scripts,dist/is unchanged, and the corrected value ships with whatever release this library cuts next.nest-queuecarries it in1.0.6.