Fail closed on npm publication state (v1.2.3)

[karlwaldman]

Summary

• replace ambiguous npm view --json | jq ... || true publication detection with a built-in-fetch resolver
• treat only exact HTTP 404 as absent; require exact name/version/SHA-512 integrity for present; fail closed on malformed, mismatch, 5xx, and network errors
• verify both the exact public version and latest against the checksummed tarball before completing release
• retain immutable halted v1.2.2 and bump the registry recovery release to v1.2.3

Red-green evidence

• Exact v1.2.2 release run 31508966331: unprivileged verify green, publisher failed because npm E404 JSON was coerced into non-empty integrity; public registry independently returned E404
• Red: resolver module missing, workflow retained npm view/|| true, and version contract was 1.2.2
• Green: 34 test files, 490 passed / 1 skipped; resolver cases cover 404, exact version, exact latest, name/version/integrity mismatch, malformed metadata/JSON, 503, and network errors
• Green: lint, TypeScript, audit 0, 36 public surfaces, build, 6/6 snippet fixtures, exact packed ESM/CJS smoke, and six authenticated production tests
• Live registry resolver reports absent for oilpriceapi@1.2.3

The v1.2.2 GitHub release is marked prerelease/non-latest with an explicit halted notice. The orphan v1.4.1 tag remains untouched.

Summary by CodeRabbit

• New Features

  • Improved release validation to distinguish unpublished, already-published, and invalid package states.
  • Releases now verify the exact public package version, tarball integrity, and latest tag.

• Bug Fixes

  • Prevented releases from proceeding when registry responses are malformed, mismatched, unavailable, or affected by network errors.

• Chores

  • Updated the SDK and package version to 1.2.3.
  • Added automated coverage for publication-state and release-readiness checks.

[coderabbitai]

Warning

Review limit reached

@karlwaldman, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 35251658-2fe2-445d-9152-81c3e3ce95a2

📥 Commits

Reviewing files that changed from the base of the PR and between ffcb1a3 and 53f86f9.

📒 Files selected for processing (2)

• scripts/resolve-npm-publication.mjs
• tests/npm-publication-state.test.ts

📝 Walkthrough

Walkthrough

The release updates version 1.2.3 and adds an npm publication resolver. The publish workflow uses the resolver to distinguish absent, valid, and invalid publication states before publishing and during post-publication verification.

Changes

NPM publication verification

Layer / File(s)	Summary
Release version contract package.json, src/version.ts, CHANGELOG.md	The package and SDK versions change to 1.2.3. The changelog records publication-state and tarball verification rules.
Publication resolver and state validation scripts/resolve-npm-publication.mjs, tests/npm-publication-state.test.ts	The resolver validates npm responses, package metadata, selectors, integrity values, timeouts, and CLI modes. Tests cover absent, present, malformed, HTTP-error, and network-failure states.
Release workflow integration .github/workflows/publish.yml, tests/release-readiness.test.ts	The workflow includes and runs the resolver before publication and during recovery verification. Readiness tests enforce resolver usage and the updated version.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant publishJob
  participant resolveNpmPublicationState
  participant npmRegistry
  publishJob->>resolveNpmPublicationState: Check publication-state
  resolveNpmPublicationState->>npmRegistry: Validate expected version and integrity
  npmRegistry-->>resolveNpmPublicationState: Return publication metadata
  resolveNpmPublicationState-->>publishJob: Return absent, present, or error
  publishJob->>npmRegistry: Publish when state is absent
  publishJob->>resolveNpmPublicationState: Require present package and latest selector
  resolveNpmPublicationState->>npmRegistry: Verify published metadata

Loading

Possibly related PRs

• OilpriceAPI/oilpriceapi-node#13: Both PRs update release versions and SDK_VERSION.
• OilpriceAPI/oilpriceapi-node#63: Both PRs strengthen publish workflow and release-readiness validation.
• OilpriceAPI/oilpriceapi-node#65: Both PRs harden npm publication workflow checks and their tests.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fail-closed handling for npm publication state in version 1.2.3.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/npm-publication-recovery-20260811

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/resolve-npm-publication.mjs`:
- Around line 14-19: Update requireIntegrity in
scripts/resolve-npm-publication.mjs at lines 14-19 to decode the SRI payload
after the existing syntax check and reject it unless the decoded digest is
exactly 64 bytes. In tests/npm-publication-state.test.ts at lines 4-8, replace
the short integrity fixture with a valid 64-byte SHA-512 SRI value and add a
test asserting that a short digest is rejected.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f29ac10e-7f86-4f7b-a256-44840095b11d

📥 Commits

Reviewing files that changed from the base of the PR and between 93baf77 and ffcb1a3.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• .github/workflows/publish.yml
• CHANGELOG.md
• package.json
• scripts/resolve-npm-publication.mjs
• src/version.ts
• tests/npm-publication-state.test.ts
• tests/release-readiness.test.ts