fix(ci): publish release with npm instead of ut publish#6016
Conversation
`ut publish` rejects npm-native flags, so the Manual Release workflow failed with `error: unexpected argument '--access' found`, and utoo cannot do npm trusted publishing / provenance via OIDC. Switch `scripts/publish.js` back to `npm publish`. npm understands neither the pnpm/utoo `workspace:` / `catalog:` dependency protocols nor `publishConfig` field hoisting — both of which `pnpm publish` handled for us before the utoo migration. So the publish script now prepares each manifest right before publishing and restores it in a `finally`: - resolve `workspace:*` -> exact in-repo version and `catalog:` / `catalog:<name>` -> the spec from pnpm-workspace.yaml - hoist `publishConfig` overrides (notably `exports`, which points at `dist/`) onto the top-level manifest; without this, published packages would expose an `exports` map pointing at `./src/*.ts` files that are not in the tarball (`files: ["dist"]`), breaking every consumer's import Verified across all 79 publishable packages that the rewrite leaves no `workspace:`/`catalog:` specifiers and reproduces the last pnpm-published manifests exactly (@eggjs/router named catalog, @eggjs/security, @eggjs/core), and that `npm pack` of @eggjs/core resolves `exports` to `./dist/index.js`. Also use the resolved npm binary in isPublished() for Windows parity and drop a now-redundant private filter in sync-cnpm.js. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe publish pipeline switches from Changesnpm-native publish with manifest rewriting
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying egg with
|
| Latest commit: |
63bcebc
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://ce2eb24c.egg-cci.pages.dev |
| Branch Preview URL: | https://claude-keen-cerf-431678.egg-cci.pages.dev |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## next #6016 +/- ##
=======================================
Coverage 81.95% 81.95%
=======================================
Files 677 677
Lines 20652 20652
Branches 4100 4100
=======================================
Hits 16925 16925
Misses 3214 3214
Partials 513 513 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Deploying egg-v3 with
|
| Latest commit: |
63bcebc
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://e4b716b6.egg-v3.pages.dev |
| Branch Preview URL: | https://claude-keen-cerf-431678.egg-v3.pages.dev |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the package publishing scripts to use npm directly instead of ut publish, ensuring support for npm trusted publishing and provenance via OIDC. It introduces manifest rewriting in scripts/publish.js and scripts/utils.js to resolve workspace: and catalog: protocol specifiers and hoist publishConfig overrides before publishing, restoring the original manifest afterwards. Additionally, it simplifies scripts/sync-cnpm.js by removing redundant filtering. I have no feedback to provide as there are no review comments to address.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
In `--dry-run` mode the retry loop was skipped (`!isDryRun`), but failed packages were only ever moved into `finalFailed` inside that loop. So a dry-run collected failures into `toRetry` and then dropped them, exiting 0 even when every package failed to pack — making the "Publish packages (dry run)" step go green while nothing actually succeeded. Report dry-run failures directly (a dry-run retry would only reproduce the same result) so the step exits non-zero on any failure, which is the whole point of the pre-flight check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Motivation
The Manual Release run failed at the Publish packages step:
ut publishdoes not accept npm-native flags (--access,--provenance), and more importantly it cannot do npm trusted publishing / provenance via OIDC — which is the whole reason the release workflow uses them. So this switchesscripts/publish.jsback tonpm publish.The catch: npm doesn't replicate everything
pnpm publishdidA naive
ut→npmswap would publish broken packages, because npm understands neither of two things thatpnpm publishhandled for us before the utoo migration:workspace:/catalog:protocol specifiers. 79 publishable packages shipworkspace:*,catalog:andcatalog:path-to-regexp1in their runtimedependencies(984 such specs). npm publishes them verbatim → uninstallable packages.publishConfigfield hoisting. 77/79 packages set a dev-time rootexportspointing at./src/*.tsand apublishConfig.exportspointing at compiled./dist/*.js. pnpm hoistspublishConfigon publish; npm does not. Sincefiles: ["dist"], the source isn't even in the tarball — every consumer'simport 'egg'would resolve to a non-existent./src/index.ts. (npm exits 0 either way, so it fails silently.)Changes
scripts/publish.jsnow prepares each manifest right beforenpm publishand restores it in afinally(crash-safe), mirroring pnpm:workspace:*→ exact in-repo version,workspace:^/~→ prefixed;catalog:/catalog:<name>→ the spec frompnpm-workspace.yamlpublishConfigoverrides (notablyexports) onto the top-level manifestscripts/utils.jsgainsgetWorkspaceVersionMap,getCatalogs,resolveWorkspaceProtocols, andapplyPublishConfigOverrides(and acollectWorkspacePackagesrefactor that keepsgetPublishablePackagesbehavior identical). Also:isPublished()now uses the resolvednpm/npm.cmdbinary for Windows parity, and a redundant.filter(!private)insync-cnpm.jsis dropped.Tests / verification
workspace:/catalog:specifiers after rewrite; everyworkspace:*→ exact version, everycatalog:→ its table spec.@eggjs/router(path-to-regexp: ^1.9.0via the named catalog),@eggjs/security(@eggjs/ip: ^2.1.0,@eggjs/path-matchingexact), and@eggjs/corereproduce exactly.publishConfig.exportshoisted for all 77 packages that declare it; 0 resolvedexportsleft pointing atsrc/.npm packof@eggjs/corewith the full rewrite producesexports["."] = "./dist/index.js"; the manifest is restored afterwards (git clean).npm publish --dry-runaccepts--access/--tag/--dry-run(the flagsut publishrejected).oxfmt --checkandoxlint --type-awareclean; pre-commit hook passes.🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Bug Fixes
Behavior Changes