Repository navigation
Publish the CLI from CI when main gains a new version - #10
Merged
Merged
Conversation
added 2 commits
October 21, 2026 11:11
Merging to main publishes package.json when that version is not already on npm. The automation token is the NPM_PUBLISH secret.
Yarn treats CI=true as an immutable install. Generated projects now set enableImmutableInstalls to false so yarn install can write yarn.lock. Docker still passes --immutable.
Reviewer's GuideThe PR adds an idempotent GitHub Actions publish job for versioned merges to main, updates documentation for the npm and binary release workflows, and adjusts generated Yarn configuration so initial CI installs can create yarn.lock files. Sequence diagram for CI npm publishing on mainsequenceDiagram
participant GitHub as GitHub Actions
participant Checks as deliverables and check jobs
participant NPM as npm registry
participant Package as @erxes/create-plugin
GitHub->>Checks: Complete required jobs
GitHub->>GitHub: Check push to refs/heads/main
GitHub->>Package: Read package.json name and version
GitHub->>NPM: npm view name@version version
alt Version already exists
NPM-->>GitHub: Return published version
GitHub-->>GitHub: Skip publish
else Version is absent
NPM-->>GitHub: Return not found
GitHub->>NPM: npm publish --access public
NPM-->>GitHub: Publish package version
end
Flow diagram for generated Yarn CI installationflowchart TD
A[Generate Yarn project] --> B[Write .yarnrc.yml]
B --> C[enableImmutableInstalls: false]
C --> D[yarn install with CI=true]
D --> E[Create initial yarn.lock]
F[Image build] --> G[yarn install --immutable]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yml" line_range="61" />
<code_context>
+ set -euo pipefail
+ name=$(node -p "require('./package.json').name")
+ version=$(node -p "require('./package.json').version")
+ if npm view "${name}@${version}" version >/dev/null 2>&1; then
+ echo "${name}@${version} is already on npm."
+ echo "Bump package.json in the merged pull request to publish a new version."
</code_context>
<issue_to_address>
**Registry errors look like missing versions**
When the npm lookup fails for a reason other than the version being absent while that version is already published, the publish step treats every `npm view` failure as an absent version and proceeds to publish. If the version already exists but the lookup fails transiently, `npm publish` reports a version conflict and the CI job fails instead of skipping the existing version.
Distinguish registry not-found responses from other lookup errors, and retry or fail with the lookup error before publishing.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and a push to main can publish the package to the public npm registry using NPM_PUBLISH; a mistakenly merged version can therefore become publicly installable and cannot be replaced under the same version. Reverting stops future publishes but does not remove that published package.
Blocking findings: .github/workflows/ci.yml:61
| set -euo pipefail | ||
| name=$(node -p "require('./package.json').name") | ||
| version=$(node -p "require('./package.json').version") | ||
| if npm view "${name}@${version}" version >/dev/null 2>&1; then |
There was a problem hiding this comment.
🟡 Medium · Registry errors look like missing versions
When the npm lookup fails for a reason other than the version being absent while that version is already published, the publish step treats every npm view failure as an absent version and proceeds to publish. If the version already exists but the lookup fails transiently, npm publish reports a version conflict and the CI job fails instead of skipping the existing version.
Distinguish registry not-found responses from other lookup errors, and retry or fail with the lookup error before publishing.
Prompt for AI agents
In `.github/workflows/ci.yml` at line 61:
**Registry errors look like missing versions**
When the npm lookup fails for a reason other than the version being absent while that version is already published, the publish step treats every `npm view` failure as an absent version and proceeds to publish. If the version already exists but the lookup fails transiently, `npm publish` reports a version conflict and the CI job fails instead of skipping the existing version.
Distinguish registry not-found responses from other lookup errors, and retry or fail with the lookup error before publishing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainpublishes@erxes/create-pluginfrom GitHub Actions whenpackage.jsonhas a version npm does not already have.0.2.1is already public, so this merge skips the upload.enableImmutableInstalls: false, so the firstyarn installcan createyarn.lockwhileCI=true. Image builds still useyarn install --immutable.Verification
pnpm test: 54 passed.CI=trueandenableImmutableInstalls: falsecreatedyarn.lock.npm publish.Summary by Sourcery
Publish new package versions from main through CI and make generated Yarn projects initialize reliably in CI.
New Features:
Bug Fixes:
CI:
Documentation:
Tests: