Skip to content

Publish the directory, not the GitHub repo of the same name - #11

Merged
las7 merged 1 commit into
mainfrom
fix/publish-path-spec
Aug 19, 2026
Merged

Publish the directory, not the GitHub repo of the same name#11
las7 merged 1 commit into
mainfrom
fix/publish-path-spec

Conversation

@las7

@las7 las7 commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

npm publish npm/cli does not publish this repository's npm/cli directory. npm reads a publish argument as a package spec, and <a>/<b> is the GitHub shorthand — so npm clones github.com/npm/cli and packs the npm CLI itself. The loop's first iteration, npm/darwin-arm64, names a repository that does not exist, so a release would have died on:

npm error command git --no-replace-objects ls-remote ssh://git@github.com/npm/darwin-arm64.git
npm error git@github.com: Permission denied (publickey).

which reads like an auth problem with our own registry and says nothing about a path. Only a spec starting with ., / or ~/ is read as a directory.

Reproduced on npm 11.19.0, the version release.yml installs:

command packs
npm publish "npm/cli" npm@12.0.2 (the npm CLI, from GitHub)
npm publish "./npm/cli" @reachpad/cli@0.4.1, 4 files

This is the second half of the reason nothing has ever been published by the workflow. #10 fixed the test-order failure that killed the npm job two steps early on cli-v0.4.0; this is what the job would have hit next. The by-hand loop in npm/README.md had the same bug.

The new test parses release.yml and npm/README.md rather than restating the command, so a future publish line has to name a path too. Verified failing on the pre-fix workflow, passing after.

Still open before a tag publishes on its own: the trusted publisher must be configured for each of the five packages at npmjs.com (they now exist, so it can be).

`npm publish npm/cli` does not publish this repository's npm/cli directory.
npm reads the argument as a package spec, and `<a>/<b>` is the GitHub
shorthand, so npm clones github.com/npm/cli and packs the npm CLI itself.
The loop's first iteration, `npm/darwin-arm64`, names a repository that does
not exist, so the release would have died on `git ls-remote ... Permission
denied (publickey)` -- an error that reads like an auth problem with our own
registry and says nothing about a path. Only a spec starting with `.`, `/`
or `~/` is read as a directory.

Reproduced on npm 11.19.0, the version release.yml installs: the bare form
packs `npm@12.0.2`, the `./` form packs `@reachpad/cli@0.4.1` with its four
files. Same fix in npm/README.md's by-hand loop, which had the same bug.

The new test parses both files rather than restating the command, so a future
publish line has to be a path too. It fails on the pre-fix workflow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBLfBLaR2Z3oWEhb4FcGnT

Greentree-Change-Id: 9f8303ecee1b51f439d184cdd18dedf6
@las7
las7 merged commit 30c2725 into main Aug 19, 2026
2 checks passed
@las7
las7 deleted the fix/publish-path-spec branch August 19, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant