Repository navigation
fix(ci): fail dist-tag removal step when npm rejects a delete - #984
Closed
kucherenko wants to merge 1 commit into
Closed
kucherenko wants to merge 1 commit into
kucherenko wants to merge 1 commit into
Conversation
The step chained 'npm dist-tag rm ... && echo removed', and under set -e a failing command inside an && list is exempt from exit-on-error. Its first run turned three 403 Forbidden responses into a green step that reported having removed nothing. Use an explicit if/else, track failures, and exit non-zero with a note that npm rejects dist-tag deletion for token auth on 2FA-enabled accounts so it has to be done from a terminal.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by the first real run of the cleanup workflow (run 33316058708).
The bug
The step chained:
Under
set -e, a failing command inside an&&list is exempt from exit-on-error. npm returned 403 Forbidden for all three tags, noremoved:line was ever printed, and the step still reported success — a cleanup workflow that silently does nothing is worse than one that fails.The fix
Explicit
if/else, afailedflag, and a non-zero exit that explains the cause.Why the 403 (not a permissions problem)
The same token successfully deprecated 147 versions in the same run, so it has package write access. npm gates dist-tag deletion behind interactive 2FA and rejects token auth for it — consistent with the
EOTPthe same command produces from a laptop. Tag removal therefore has to be done from a terminal:The failure message now says exactly that, so the next person doesn't have to rediscover it.
This change is