From fdd98998e40babc364e44b26fdf5016f5f0b207a Mon Sep 17 00:00:00 2001 From: Joaquin Terrasa Date: Wed, 1 Jul 2026 18:49:45 +0200 Subject: [PATCH] fix(ci): guard release workflow against publishing stale versions as latest A replayed old tag once caused npm's latest dist-tag to jump backward across 15 packages when changesets published an already-versioned commit with zero semver-order awareness. Block any future publish whose local version isn't strictly greater than the currently published latest. --- .github/workflows/release.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cf0d05c..6227b68 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -41,6 +41,25 @@ jobs: - name: Build packages run: pnpm --filter './packages/**' build + - name: Guard against publishing an older version as latest + run: | + set -euo pipefail + for dir in packages/*/; do + pkg_json="${dir}package.json" + [ -f "$pkg_json" ] || continue + is_private=$(node -p "require('./$pkg_json').private === true") + [ "$is_private" = "true" ] && continue + name=$(node -p "require('./$pkg_json').name") + local_version=$(node -p "require('./$pkg_json').version") + published_latest=$(npm view "$name" dist-tags.latest 2>/dev/null || echo "") + if [ -n "$published_latest" ]; then + if ! npx --yes semver "$local_version" -r ">$published_latest" >/dev/null 2>&1; then + echo "::error::$name: local version $local_version is not greater than published latest ($published_latest). Refusing to publish — this would move npm's 'latest' tag backwards." + exit 1 + fi + fi + done + - name: Create release PR or publish to npm id: changesets uses: changesets/action@v1