fix(ci): retry npm provenance lookup

.github/workflows/release.yml

@@ -174,15 +174,34 @@ jobs:
           if (typeof attestationsUrl !== "string") {
             throw new Error(`${name}@${process.env.RELEASE_VERSION} has no npm provenance.`);
           }
-          const attestationsResponse = await fetch(attestationsUrl, {
-            signal: AbortSignal.timeout(15_000),
-          });
-          if (!attestationsResponse.ok) {
-            throw new Error(`The npm attestation registry returned HTTP ${attestationsResponse.status}.`);
+          let attestations;
+          for (let attempt = 1; attempt <= 12; attempt++) {
+            const response = await fetch(attestationsUrl, {
+              signal: AbortSignal.timeout(15_000),
+            });
+            if (response.ok) {
+              attestations = await response.json();
+              if (
+                attestations.attestations?.some(
+                  (item) =>
+                    item.predicateType === "https://slsa.dev/provenance/v1" &&
+                    item.bundle?.dsseEnvelope?.payload,
+                )
+              ) {
+                break;
+              }
+            } else if (response.status !== 404) {
+              throw new Error(`The npm attestation registry returned HTTP ${response.status}.`);
+            }
+            if (attempt === 12) {
+              throw new Error(`${name}@${process.env.RELEASE_VERSION} has no SLSA provenance.`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
           }
-          const attestations = await attestationsResponse.json();
           const provenance = attestations.attestations?.find(
-            (item) => item.predicateType === "https://slsa.dev/provenance/v1",
+            (item) =>
+              item.predicateType === "https://slsa.dev/provenance/v1" &&
+              item.bundle?.dsseEnvelope?.payload,
           );
           if (!provenance?.bundle?.dsseEnvelope?.payload) {
             throw new Error(`${name}@${process.env.RELEASE_VERSION} has no SLSA provenance.`);
@@ -337,15 +356,34 @@ jobs:
           if (metadata.dist?.integrity !== process.env.NPM_INTEGRITY) {
             throw new Error("The published npm package has different bytes.");
           }
-          const attestationsResponse = await fetch(metadata.dist.attestations.url, {
-            signal: AbortSignal.timeout(15_000),
-          });
-          if (!attestationsResponse.ok) {
-            throw new Error(`The npm attestation registry returned HTTP ${attestationsResponse.status}.`);
+          let attestations;
+          for (let attempt = 1; attempt <= 12; attempt++) {
+            const response = await fetch(metadata.dist.attestations.url, {
+              signal: AbortSignal.timeout(15_000),
+            });
+            if (response.ok) {
+              attestations = await response.json();
+              if (
+                attestations.attestations?.some(
+                  (item) =>
+                    item.predicateType === "https://slsa.dev/provenance/v1" &&
+                    item.bundle?.dsseEnvelope?.payload,
+                )
+              ) {
+                break;
+              }
+            } else if (response.status !== 404) {
+              throw new Error(`The npm attestation registry returned HTTP ${response.status}.`);
+            }
+            if (attempt === 12) {
+              throw new Error("The npm provenance did not become available.");
+            }
+            await new Promise((resolve) => setTimeout(resolve, 5_000));
           }
-          const attestations = await attestationsResponse.json();
           const provenance = attestations.attestations?.find(
-            (item) => item.predicateType === "https://slsa.dev/provenance/v1",
+            (item) =>
+              item.predicateType === "https://slsa.dev/provenance/v1" &&
+              item.bundle?.dsseEnvelope?.payload,
           );
           if (!provenance?.bundle?.dsseEnvelope?.payload) {
             throw new Error("The npm package has no SLSA provenance.");

apps/api/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secret-effects/api",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"private": true,
 	"type": "module",
 	"dependencies": {

apps/cli/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secret-effects/cli",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"private": true,
 	"type": "module",
 	"bin": {

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "secret-effects",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"private": true,
 	"type": "module",
 	"license": "MIT",

packages/client/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@paperkeel/secret-effects-client",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"description": "Type-safe Secret Effects environment loading for Node.js and Cloudflare Workers",
 	"type": "module",
 	"license": "MIT",

packages/crypto/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secret-effects/crypto",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"type": "module",
 	"license": "MIT",
 	"exports": {

packages/protocol/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secret-effects/protocol",
-	"version": "0.2.2",
+	"version": "0.2.3",
 	"type": "module",
 	"license": "MIT",
 	"exports": {