Repository navigation
fix(ci): wait for npm to make a published version visible - #8371
Merged
Merged
Conversation
noomorph
added a commit
to wix/react-native-ui-lib
that referenced
this pull request
Nov 2, 2026
…deps - Backport wix/react-native-navigation#8370: RELEASE_DIR without `..` (upload-artifact rejects it), upload-artifact v7.0.2, Node 24.22.1. - Backport wix/react-native-navigation#8371: poll the registry until a just-published version is visible instead of failing the run; publish and finalize get 70 min for two packages. - Version PR lookup uses the repository owner instead of a hard-coded `wix:`. - peerDependencies: drop the self-peer and the stale uilib-native snapshot range (published 9.1.3 has `^5.0.1`; the snapshot caused ERESOLVE with uilib-native 5.1.x), restore react-native-safe-area-context. - Docs deploy from master, since releases are cut from master. - RELEASING.md: baseline tag commit for 9.1.3, `npm trust --allow-publish`, E409 recovery row. Verified end to end in a public sandbox publishing scoped copies: dry run, snapshot, release with native, JS-only release, cancel + resume.
noomorph
added a commit
to wix/Detox
that referenced
this pull request
Nov 2, 2026
noomorph
added a commit
to wix/react-native-ui-lib
that referenced
this pull request
Nov 2, 2026
…d publishing) (#4056) * ci: move npm releases to admin-dispatched GitHub Actions with OIDC trusted publishing Replaces the Buildkite-driven, NPM_TOKEN-based publisher of react-native-ui-lib and uilib-native with a manually dispatched Release workflow on master, ported from react-native-navigation's release contract: dry-run / publish / resume, immutable artifacts, npm trusted publishing via GitHub OIDC, registry-integrity recovery, package-qualified tags, GitHub release, and a version PR. * ci(release): wait for npm visibility, fix dry-run path, correct peer deps - Backport wix/react-native-navigation#8370: RELEASE_DIR without `..` (upload-artifact rejects it), upload-artifact v7.0.2, Node 24.22.1. - Backport wix/react-native-navigation#8371: poll the registry until a just-published version is visible instead of failing the run; publish and finalize get 70 min for two packages. - Version PR lookup uses the repository owner instead of a hard-coded `wix:`. - peerDependencies: drop the self-peer and the stale uilib-native snapshot range (published 9.1.3 has `^5.0.1`; the snapshot caused ERESOLVE with uilib-native 5.1.x), restore react-native-safe-area-context. - Docs deploy from master, since releases are cut from master. - RELEASING.md: baseline tag commit for 9.1.3, `npm trust --allow-publish`, E409 recovery row. Verified end to end in a public sandbox publishing scoped copies: dry run, snapshot, release with native, JS-only release, cancel + resume. * ci(release): name the version PR branch infra/update-version-<v> Matches the repository's branch prefixes (Maintenance & Infra); the version PR's changelog is 'none', so it never appears in release notes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
After
npm publish, npm runs an automated malware scan and the version stays unavailable (registry returns 404) until it finishes. Usually ~5 min, can be 15+, no documented upper bound. The release scripts checked the registry once, right after publish, so thepublishjob failed even though the package was published (run 39783204995) and needed a manualresume.finalizepublishandfinalizejob timeout 10 -> 40 minLimit and interval are my choice; npm gives no guarantee.
Source: https://github.blog/changelog/2026-07-28-npm-publish-time-malware-scanning-and-dual-use-metadata/