From 55f0f672d28f8db6e8d6d236b935ca7866c6569e Mon Sep 17 00:00:00 2001 From: Dan Draper Date: Wed, 19 Aug 2026 16:29:49 +1000 Subject: [PATCH] fix(release): publish the FFI tarballs by path, not GitHub shorthand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first 2.0.0 release attempt failed in `Publish FFI packages` on the very first tarball: npm error command git --no-replace-objects ls-remote ssh://git@github.com/ffi-dist/cipherstash-protect-ffi-darwin-arm64-0.32.0.tgz.git `npm publish` was handed the bare relative path `ffi-dist/.tgz`, and npm's spec parser classifies an `owner/repo`-shaped argument as a GitHub shorthand before it considers it a file — so it tried to clone a repository named after the tarball and died on SSH auth. A spec is only treated as a local tarball when it starts with `./`, `../`, `/` or `file:`. Prefix the path with `./`. Nothing else in the step is affected: the `tar` reads and `npm view` probes never used the path as a package spec. Trusted publishing was never exercised by the failure — the run died before npm talked to the registry — so this fix is necessary for the next release attempt but not yet proven sufficient; check `npm trust list` on the seven packages before retrying (AGENTS.md, "Publishing has moved here"). Note the workflow filename must not change: npm trusted publishing for all seven FFI packages binds to (repository, workflow filename). --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ae03d708a..15708561f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -146,7 +146,12 @@ jobs: if npm view "${name}@${version}" version >/dev/null 2>&1; then echo "${name}@${version} already published — skipping" else - npm publish --access public --provenance "$tgz" + # "./" is load-bearing: npm classifies a bare `dir/file.tgz` + # argument as a GitHub `owner/repo` shorthand before it considers + # it a file, then dies in `git ls-remote` — which is exactly how + # the first 2.0.0 release attempt failed. A path-ish spec is only + # treated as a tarball when it starts with ./, ../, / or file:. + npm publish --access public --provenance "./$tgz" fi published+=("${name}@${version}") done