Skip to content

ci: fix release Pack step writing multi-line output to GITHUB_OUTPUT - #26

Merged
llbbl merged 1 commit into
mainfrom
ci/fix-release-pack-step
Jul 28, 2026
Merged

ci: fix release Pack step writing multi-line output to GITHUB_OUTPUT#26
llbbl merged 1 commit into
mainfrom
ci/fix-release-pack-step

Conversation

@llbbl

@llbbl llbbl commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • The v0.1.1 tag was pushed and the release workflow ran, but it failed at the Pack step, before npm publish — nothing was published, so 0.1.1 is not burned.
  • Cause: npm pack --silent still prints the prepack lifecycle banner to stdout on the runner, so tarball="$(npm pack --silent)" captured a multi-line string, and writing that to $GITHUB_OUTPUT failed with "Unable to process file command 'output'".
  • Fix builds explicitly, packs with --ignore-scripts so no lifecycle output is produced, and derives the tarball filename from the manifest instead of parsing stdout — plus asserts the file exists so a future npm naming change fails loudly rather than silently.

Changes

CI

  • .github/workflows/release.yml: Pack step now runs pnpm build explicitly, packs with npm pack --ignore-scripts --silent, derives the tarball filename from package.json via node -p, and asserts the file exists before writing it to $GITHUB_OUTPUT.

Test plan

  • actionlint clean
  • Derived filename confirmed single-line and correct
  • attw and publint both pass against that exact tarball with src/ present

Refs #7

The v0.1.1 tag was pushed and the release workflow ran, but failed at
the Pack step before npm publish, so nothing was published and 0.1.1
is not burned.

`npm pack --silent` still prints the prepack lifecycle banner to
stdout on the runner, so `tarball="$(npm pack --silent)"` captured a
multi-line string. Writing that to $GITHUB_OUTPUT failed with
"Unable to process file command 'output'", failing the job before
publish.

Fix:
- Build explicitly instead of relying on npm's prepack lifecycle hook.
- Pack with --ignore-scripts so no lifecycle output is produced.
- Derive the tarball filename from package.json instead of parsing
  pack's stdout, and assert the file exists so a future npm naming
  change fails loudly instead of silently.

Refs #7
@llbbl
llbbl merged commit fa802c7 into main Jul 28, 2026
4 checks passed
@llbbl
llbbl deleted the ci/fix-release-pack-step branch July 28, 2026 14:35
@llbbl llbbl mentioned this pull request Jul 28, 2026
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant