Skip to content

fix(release): retry npm install on registry propagation lag in verify-published #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
qmarcelle merged 1 commit into from
Jul 17, 2026
Merged

fix(release): retry npm install on registry propagation lag in verify-published #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 32 additions & 1 deletion scripts/verify-published.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,18 +13,49 @@ const packages = [
{ name: "agents-audit", check: ["npx", "--no-install", "agents-audit", "--help"] },
];

// npm registry propagation lags publish by seconds to low minutes. A single
// immediate post-publish check has no way to tell "not actually published"
// apart from "not visible here yet" and fails the Release workflow either
// way — training everyone to ignore red, which is worse than no gate at all.
const REGISTRY_PROPAGATION_RETRIES = 6;
const REGISTRY_PROPAGATION_BASE_DELAY_MS = 5000;
const isRegistryPropagationLag = (stderr) => /\bE(TARGET|404)\b|No matching version found/.test(stderr ?? "");

for (const pkg of packages) {
const directory = mkdtempSync(join(tmpdir(), "workspacejson-registry-"));
try {
writeFileSync(join(directory, "package.json"), JSON.stringify({ private: true, type: "module" }));
run("npm", ["install", "--ignore-scripts", "--no-package-lock", `${pkg.name}@${version}`], directory);
await installWithRetry(pkg, directory);
run(pkg.check[0], pkg.check.slice(1), directory);
console.log(`Verified registry install and runtime entry point: ${pkg.name}@${version}`);
} finally {
rmSync(directory, { recursive: true, force: true });
}
}

async function installWithRetry(pkg, directory) {
for (let attempt = 1; attempt <= REGISTRY_PROPAGATION_RETRIES; attempt++) {
const result = spawnSync("npm", ["install", "--ignore-scripts", "--no-package-lock", `${pkg.name}@${version}`], {
cwd: directory,
encoding: "utf8",
env: { ...process.env, npm_config_cache: join(directory, ".npm-cache") },
});
if (result.status === 0) {
process.stdout.write(result.stdout);
return;
}
const lastAttempt = attempt === REGISTRY_PROPAGATION_RETRIES;
if (!isRegistryPropagationLag(result.stderr) || lastAttempt) {
process.stdout.write(result.stdout);
process.stderr.write(result.stderr);
process.exit(result.status ?? 1);
}
const delayMs = REGISTRY_PROPAGATION_BASE_DELAY_MS * attempt;
console.log(`${pkg.name}@${version} not yet visible on the registry (attempt ${attempt}/${REGISTRY_PROPAGATION_RETRIES}) — retrying in ${delayMs}ms`);
await new Promise((resolve) => setTimeout(resolve, delayMs));
}
}

function run(command, args, cwd) {
const result = spawnSync(command, args, {
cwd,
Expand Down
Loading