Tracked from the v1.6.4 cross-audit (dimension d). The publish-hardening PR (in progress) covers the environment: release gate, tag-creation restriction, tag-name↔version assert, version-lockstep-in-CI (done in the lockstep PR), and the dist-tag suffix fix. This issue tracks the remaining publish-robustness findings NOT in that PR:
- Partial-publish window (MEDIUM) —
.github/workflows/publish.yml publishes @ijfw/install then @ijfw/memory-server sequentially with no pre-check and no rollback. If the second publish fails (registry blip / E409), the two packages are left at mismatched live versions until a human intervenes; nothing deprecates the half-shipped installer. Fix: pre-assert both npm view @pkg@$VERSION are ABSENT before publishing either; on second-step failure, npm deprecate the first.
- Post-publish E2E is action-free (MEDIUM) — the
post-publish-smoke job fails the run red but has no if: failure() step: no npm deprecate, no notification, no issue, and the GitHub Release was already created in the publish job BEFORE smoke ran. A broken latest stays live behind a normal-looking Release unless someone watches the Actions tab. Fix: add a failure-path step that deprecates both packages at that version and opens an issue / notifies.
Both verified by the publish-pipeline audit (adversarial pass). Severity MEDIUM (release-day robustness, not a routine-path bug). Filing so they're tracked separately from the hardening PR.
Tracked from the v1.6.4 cross-audit (dimension d). The publish-hardening PR (in progress) covers the
environment: releasegate, tag-creation restriction, tag-name↔version assert, version-lockstep-in-CI (done in the lockstep PR), and the dist-tag suffix fix. This issue tracks the remaining publish-robustness findings NOT in that PR:.github/workflows/publish.ymlpublishes@ijfw/installthen@ijfw/memory-serversequentially with no pre-check and no rollback. If the second publish fails (registry blip / E409), the two packages are left at mismatched live versions until a human intervenes; nothing deprecates the half-shipped installer. Fix: pre-assert bothnpm view @pkg@$VERSIONare ABSENT before publishing either; on second-step failure,npm deprecatethe first.post-publish-smokejob fails the run red but has noif: failure()step: nonpm deprecate, no notification, no issue, and the GitHub Release was already created in the publish job BEFORE smoke ran. A brokenlateststays live behind a normal-looking Release unless someone watches the Actions tab. Fix: add a failure-path step that deprecates both packages at that version and opens an issue / notifies.Both verified by the publish-pipeline audit (adversarial pass). Severity MEDIUM (release-day robustness, not a routine-path bug). Filing so they're tracked separately from the hardening PR.