Skip to content

fix: stop aiming the release at npmjs - #27

Merged
catinspace-au merged 1 commit into
mainfrom
fix/no-npm-publish-destination
Aug 3, 2026
Merged

fix: stop aiming the release at npmjs#27
catinspace-au merged 1 commit into
mainfrom
fix/no-npm-publish-destination

Conversation

@catinspace-au

Copy link
Copy Markdown
Contributor

Releasing this repo fails at preflight:

npm: NPM_TOKEN not set - npm publish cannot authenticate
Cloudflare R2: credentials present
Publish would fail on missing ... or opt out of the destination with
`publish.destinations_oss.<artefact>: false`

That reads like a missing secret. It is not - it is a destination this repo
should never have had. The same language detection that makes hyperi-ci run the
TypeScript quality handler here (package.json, which exists only to carry the
semantic-release scripts) also aims publish at npmjs.

We are opting out rather than supplying a token, because this repo has no
publish target at all:

$ gh release view v2.24.4 --json assets
{"assets":[]}

v2.24.4 shipped nothing, anywhere. install.sh is run from a clone, not fetched
from a registry, so a release here is a tag, a CHANGELOG commit and a GitHub
Release. Supplying NPM_TOKEN would put an Ansible installer on a public package
registry.

publish stays enabled, because that is what tags and cuts the release.

Done when: hyperi-ci publish gets past preflight and moves the tag.

Verified: the merged config now reports "npm": false
(hyperi-ci config --json). The failing run is
https://github.com/hyperi-io/hyperi-developer/actions/runs/30785807629 - it
died in Plan, so nothing was tagged or published and there is nothing to
unwind.

Releases fail preflight with "npm: NPM_TOKEN not set", which reads like a
missing secret and is actually a false destination. The language detection that
makes hyperi-ci run the TypeScript quality handler here -- package.json, which
exists only to carry the semantic-release scripts -- also points publish at
npmjs.

Opting out rather than supplying a token. This repo has no publish target at
all: v2.24.4 shipped zero assets, and install.sh is run from a clone rather
than fetched from a registry, so a release is a tag, a CHANGELOG commit and a
GitHub Release. Supplying NPM_TOKEN would put an Ansible installer on a public
package registry.

`publish` stays enabled, because that is what tags and cuts the release.
@catinspace-au
catinspace-au merged commit 44bbd79 into main Aug 3, 2026
15 checks passed
@catinspace-au
catinspace-au deleted the fix/no-npm-publish-destination branch August 3, 2026 05:11
@github-actions

github-actions Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant