feat: promote npm edge tag to latest when prerelease is promoted#86
feat: promote npm edge tag to latest when prerelease is promoted#86AaronFeledy merged 3 commits intomainfrom
Conversation
Reproduces lando/lando#3833 — Backdrop recipe with MySQL 5.7 where mysql/mysqldump commands from the appserver fail with TLS/SSL errors due to self-signed certificates.
…ario The reporter used the default MySQL version (no version pinned), which is the more realistic test case.
✅ Deploy Preview for lando-backdrop ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Adds a 'released' trigger to the release workflow with a lightweight 'promote' job that runs npm dist-tag to move 'latest' to the current version when a prerelease is promoted to a full release. The existing publish pipeline remains gated to 'published' events only.
AaronFeledy
force-pushed
the
feature/promote-edge-on-edit
branch
from
6396cbc to
bac7c74
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| echo "::notice title=Promoted $VERSION to latest::The latest tag now points to $VERSION (was edge-only)" | ||
| env: | ||
| TAG_NAME: ${{ github.event.release.tag_name }} | ||
| NODE_AUTH_TOKEN: ${{secrets.NPM_DEPLOY_TOKEN}} |
There was a problem hiding this comment.
Race condition: promote fails before deploy publishes package
Medium Severity
When a fresh non-prerelease is published, GitHub fires both published and released events as separate workflow runs. The promote job (~15s) will finish well before deploy (minutes of install, lint, test, publish). The npm dist-tag add command in promote will fail because the version hasn't been published to npm yet by deploy. The PR description claims this is "harmless" but it will produce a failed workflow run. Adding needs: deploy wouldn't help since they're in separate workflow runs. The promote job's if condition could also check github.event.release.prerelease == true to only run for actual prerelease promotions.
Additional Locations (1)
1 participant
Problem
When a release is published as a prerelease, it gets tagged as
edgeon npm. Later, when the release is promoted to a full release in GitHub, the npmlatesttag doesn't update because the workflow only triggered onpublished.Solution
releasedto the release workflow trigger typespromotejob that only runsnpm dist-tag add latest— no install, no lint, no tests, no re-publishreleasedevent (when a prerelease is promoted to full release)deployjob is now explicitly gated topublishedevents only (no behavior change)TAG_NAMEenv var instead of direct interpolation to prevent script injectionFlow
edgetag (unchanged)promotejob runs, pointslatestto that version (~15s)The
dist-tag addcommand is idempotent, so if bothpublishedandreleasedfire on a fresh non-prerelease publish, the redundant promote is harmless.Note
Low Risk
Workflow-only change that adjusts npm dist-tags on promotion; main risk is mis-tagging
latestor an unexpected extra job run if release event semantics differ.Overview
The release GitHub Action now also triggers on
releasereleasedevents and adds a lightweightpromotejob that runsnpm dist-tag add ... latestfor the release tag.The existing publish pipeline is unchanged in behavior but is now explicitly gated to only run on
releasepublishedevents, preventing it from running during promotion events.Written by Cursor Bugbot for commit bac7c74. This will update automatically on new commits. Configure here.