The first npm release and trusted publishing
npm trusted publishing can only be configured for a package that exists, so the first version had to be published by hand, which would then make the release workflow fail.
Symptoms
The GitHub release for the hand-published version would trigger the publish workflow, which would fail on an existing version.
Expected and observed behavior
- Expected
- Publishing a release is safe to re-run and does not fail for a version that is already on npm.
- Observed
- npm rejects publishing a version that already exists.
Root cause
Trusted publishing is configured per package on npm, so the package had to exist before the workflow could publish to it.
Resolution
The workflow checks npm first and exits successfully when the version is already published (pull request #74):
version=$(node -p "require('./package.json').version")
if npm view "pandapaylens@$version" version >/dev/null 2>&1; then
echo "pandapaylens@$version is already on npm."
exit 0
fi
pnpm pack
npm publish ./pandapaylens-*.tgz --provenance --access publicValidation
The pull request records that npm view was checked for both an existing and a missing version. Version 0.14.0 is on npm with provenance.