fix(release): stop clobbering binaries semantic-release already uploaded - #41
Open
volod-vana wants to merge 1 commit into
Open
volod-vana wants to merge 1 commit into
volod-vana wants to merge 1 commit into
Conversation
The attach step re-listed the same tarballs semantic-release had just published and pushed them again with `--clobber`, which deletes the good asset before writing the replacement. When the uploads API returned a 500 mid-flight on v0.24.0 the release was left advertising checksums for tarballs that no longer existed, and the failed step skipped publish-npm. Collect only the assets semantic-release does not own, and retry the upload, which took two attempts by hand even for a 50KB gif.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
v0.24.0 shipped a GitHub release with two of its four binaries missing.
@semantic-release/githubuploads the tarballs, the zip and their checksums. TheAttach release assetsstep then rancollect-release-assets.mjs, which lists that same set again, and re-uploaded it with--clobber.--clobberdeletes the existing asset before writing the replacement, so every release has a window where the binaries do not exist.The uploads API returned
HTTP 500inside that window. Result:vana-linux-x64.tar.gzandvana-darwin-arm64.tar.gzwere gone while their.sha256files remained, pointing at 404s. Because the step failed,publish-npmandverify-release-installwere both skipped, so npm stayed on 0.23.13.Rerunning the job reproduced it exactly: the clobber wiped all four binaries, restored three, and 500'd on
vana-win32-x64.zip.The fix
collect-release-assets.mjstakes--skip-binaries, and the release workflow passes it. The step now uploads only what semantic-release does not own: the Homebrew formula, the winget manifest, and the demo assets. Prereleases keep the old behaviour because semantic-release never runs there, so they still need the binaries from this script.Error creating asset temp dir). A blip here also strands the npm publish behind a GitHub release that already shipped.v0.24.0
Already repaired by hand. All four binaries are back and byte-identical to the checksums the release publishes, and the darwin-arm64 build runs and reports
0.24.0with a validDeveloper ID Application: Corsali, Incsignature.npm is still on 0.23.13. Merging this cuts a patch through the fixed path, which publishes npm and runs the install smoke test.
Test plan
pnpm validategreen, 376 testscollect-release-assets.mjsemits binaries by default and drops only them under--skip-binariespublish-npmjob runs