[plum117]

Proposed changes

The 9.33.0 and 9.33.1 publish runs (41533530853, 41549118680) stopped part-way with:

lerna ERR! TLOG_CREATE_ENTRY_ERROR error creating tlog entry - (409) an equivalent entry already exists in the transparency log with UUID ...

sigstore 4.1.1 (lerna 9.0.7 → libnpmpublish 11.1.2) gives each Rekor upload 5 s with 2 retries, and lerna passes no timeout. When Rekor saves the first upload but answers after 5 s, the retry gets a 409, and fetchOnConflict: false fails the package. 9.33.0: 1 package failed (27/38 published), 9.33.1: 6 failed (30/38). Rekor saved each failed entry 2-9 s before the error.

	Before	After
Rekor 409 after a late answer	the package fails, lerna stops	sigstore reads the existing entry (the same upload), the publish goes on
Publish that failed part-way	no way to publish the rest without a new version	releaseType: from-package: publishes only the versions that are not on npm; no version step, changelog, GitHub release or tag

• @wdio/lerna-patch also patches sigstore's config.js (fetchOnConflict: true). It throws, before anything is published, if the code changed.
• The lerna path is resolved from its real folder (node_modules/lerna is a pnpm link).

How you tested

• Mock Rekor with the real sigstore 4.1.1 of the lockfile: the 1st upload is saved but answers after 6 s, the retry gets 409.
  • Before: TLOG_CREATE_ENTRY_ERROR … (409) an equivalent entry already exists … (the CI error).
  • After: GET /api/v1/log/entries/<uuid>, the entry is returned.
• pnpm -r --filter=@wdio/lerna-patch run patch twice: Code patched, then Code already patched.
• YAML parses; releaseType options: patch, minor, major, premajor, from-package. eslint passes.
• The next publish run is the real test.

Types of changes

• Polish (an improvement for an existing feature)
• Bugfix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update (improvements to the project's docs)
• Specification changes (updates to WebDriver command specifications)
• Internal updates (everything related to internal scripts, governance documentation and CI files)

Checklist

• I have read the CONTRIBUTING doc
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation (if appropriate)
• I have added proper type definitions for new commands (if appropriate)

Backport Request

• This change is solely for v9 and doesn't need to be back-ported
• Back-ported PR at #XXXXX

Further comments

main has the same sigstore code (follow-up).

Reviewers: @webdriverio/project-committers

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues were found.

Summary

Adds a recovery option for partially published v9 releases and patches sigstore to fetch an existing Rekor entry after a conflict.

• A v9 publish can resume package versions that did not reach npm.
• A delayed Rekor reply no longer stops a package publish.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Install and build] --> B[Patch Lerna and sigstore]
  B --> C{Release type}
  C -->|from-package| D[Publish versions missing from npm]
  C -->|Version bump| E[Run normal Lerna release]
  E --> F[Push release tag]

Loading

_{Reviews (1) · Last reviewed commit: "ci: let a v9 publish survive a Rekor 409..." · Reviewed by Greptile}