feat: preflight new-package check in npm-publish-hardened#46
Conversation
Trusted publishing cannot create brand-new packages, so a first-ever publish burned all retries and failed late with an opaque ENEEDAUTH — after sibling packages had already published (seen twice this week: the win32-x64-msvc platform packages and @stll/anonymize-cli). Check the whole queue against the registry before publishing anything and fail fast with bootstrap instructions when a package has never been published. Transient npm-view failures only warn; the publish loop keeps its own retries.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a preflight check to the hardened npm publish action, verifying that all packages in the queue already exist on the registry before publishing. This prevents late failures due to OIDC trusted publishing limitations on brand-new packages. The README has also been updated with bootstrap instructions. The review feedback suggests addressing style guide violations regarding the use of em dashes in comments and documentation, and fixing a potential issue where a failure in pkg_name_from_tarball under set -e would cause the script to exit immediately, bypassing custom error handling.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| # registry. OIDC trusted publishing cannot create a brand-new package — | ||
| # npm requires a package to exist before a trusted publisher can be | ||
| # configured for it — so a first-ever publish would otherwise burn all |
There was a problem hiding this comment.
According to the Stella GitHub Development Guidelines, we should avoid using em dashes and instead prefer parentheses or other punctuation.
| # registry. OIDC trusted publishing cannot create a brand-new package — | |
| # npm requires a package to exist before a trusted publisher can be | |
| # configured for it — so a first-ever publish would otherwise burn all | |
| # registry. OIDC trusted publishing cannot create a brand-new package | |
| # (npm requires a package to exist before a trusted publisher can be | |
| # configured for it), so a first-ever publish would otherwise burn all |
References
- Vary punctuation: prefer colons, semicolons, commas, and parentheses over em dashes (link)
| # with bootstrap instructions instead. | ||
| declare -a PREFLIGHT_MISSING=() | ||
| for tarball in "${PUBLISH_QUEUE[@]}"; do | ||
| preflight_name=$(pkg_name_from_tarball "${tarball}") |
There was a problem hiding this comment.
Under set -e, if the command substitution pkg_name_from_tarball fails (e.g., if the tarball is corrupt or package.json is missing), the script will exit immediately. This prevents the custom error message and bootstrap instructions on line 108 from being displayed. Appending || preflight_name="" ensures the failure is caught gracefully and the helpful error message is printed.
| preflight_name=$(pkg_name_from_tarball "${tarball}") | |
| preflight_name=$(pkg_name_from_tarball "${tarball}") || preflight_name="" |
| Transient registry errors during the preflight only warn — the | ||
| publish loop has its own retries. |
There was a problem hiding this comment.
According to the Stella GitHub Development Guidelines, we should avoid using em dashes and instead prefer semicolons or other punctuation.
| Transient registry errors during the preflight only warn — the | |
| publish loop has its own retries. | |
| Transient registry errors during the preflight only warn; the | |
| publish loop has its own retries. |
References
- Vary punctuation: prefer colons, semicolons, commas, and parentheses over em dashes (link)
1 participant
Why
Trusted publishing cannot create brand-new packages (npm requires a package to exist before a trusted publisher can be configured). A first-ever publish therefore burns all 5 retries and fails late with an opaque
ENEEDAUTH— after sibling packages in the same queue already published. This bit us twice this week: the three*-win32-x64-msvcplatform packages, and@stll/anonymize-cli@1.4.9(stella/anonymize run 27347020154).What
Before publishing anything, check every package in the queue via
npm view <name> name:E404→ fail the run immediately (exit 2) with bootstrap instructions (placeholder publish → trusted publisher config → re-run), before anything is published::warning::and continue; the publish loop has its own retriesVerification
bash -ncleanConsumers pick this up at their next SHA pin bump of
npm-publish-hardened.CC on behalf of @jan-kubica