fix(ci): a missing publish credential is not a failure - #6
Merged
Conversation
This repo has no NPM_TOKEN, so the v0.3.0 tag built, verified, produced a correct 27.7 kB tarball — and then failed on ENEEDAUTH. Left alone, every future version tag does the same forever. That is the expensive kind of red: an X that means "nothing is wrong, a secret is absent". People learn to scroll past those, and the next thing they scroll past is a real one. This fleet already has that scar written down. So an absent token now SKIPS and says so in the job summary, including the GitHub install line that does work. Everything that proves the release is real still runs first — tag/version match, lint, typecheck, build, tests. Only the push to the registry is conditional. Add NPM_TOKEN and re-run the workflow and it publishes, with no change here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo has no
NPM_TOKEN, so thev0.3.0tag built, verified, produced a correct 27.7 kB tarball — and then failed onENEEDAUTH. Left alone, every future version tag does the same, forever.That's the expensive kind of red: an X meaning "nothing is wrong, a secret is absent". People learn to scroll past those, and the next thing they scroll past is a real one. This fleet already has that scar written down.
So an absent token now skips and says so in the job summary, including the GitHub install line that does work. Everything proving the release is real still runs first — tag/version match, lint, typecheck, build, tests. Only the push to the registry is conditional.
Add
NPM_TOKENand re-run the workflow and it publishes, with no change here.