From 773f9b9ea89cad457b0de644cc87304b0762e32a Mon Sep 17 00:00:00 2001 From: cliffhall Date: Wed, 30 Sep 2026 17:51:21 -0400 Subject: [PATCH] fix(ci): publish the tarball by a ./ path so npm reads it as a file MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release publish job did `set -- release-tarball/*.tgz` and passed that bare relative path to `npm publish`. npm reads a `dir/file` argument as GitHub `owner/repo` shorthand, so it ran `git ls-remote ssh://git@github.com/release-tarball/…` and failed with Permission denied: 2.9.0 never reached npm. This is the #2483 job split running for the first time; it can only be exercised by a real release. Prefix the glob with ./ so npm treats it as a local file. Reproduced and verified with the pinned npm@11.20.0: the bare path fails with the same git error, and the ./ path dry-runs a publish of the tarball. Closes #2551 Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: cliffhall --- .github/workflows/main.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9bce958f9..52a0c8ec5 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -385,7 +385,10 @@ jobs: # `.npmrc` that `setup-node` generates, and npm then fails `ENEEDAUTH` # before OIDC is ever attempted. Do not "restore" it. run: | - set -- release-tarball/*.tgz + # `./` is load-bearing: `npm publish` reads a bare `dir/file` + # argument as GitHub `owner/repo` shorthand and tries to clone it + # over SSH instead of publishing the local tarball (#2551). + set -- ./release-tarball/*.tgz if [ "$#" -ne 1 ] || [ ! -f "$1" ]; then echo "Expected exactly one tarball in release-tarball/, found: $*" exit 1