@exadev/semantic-release-workspace 3.0.0 → 3.0.2

package/README.md

@@ -76,6 +76,14 @@ Set it via the `--commit-strategy <mode>` CLI flag, the `commitStrategy` field i
 
 `'single'` mode still runs each package's own configured publish plugins afterward (npm publish with provenance, GitHub releases), scoped per package exactly as `'per-package'` mode does — it just runs their `verifyConditions`/`publish`/`success` steps directly against the already-committed-and-tagged repository state, since by that point semantic-release's own top-level orchestrator would misread the tag this mode already created as an existing release. `addChannel` and `fail` are not called in this mode (pre-release channel promotion and posting an automated failure comment/issue, respectively) — a deliberate scope boundary, not a silent gap: raise an issue if your workflow needs them.
 
+### When the release branch moves during a run
+
+Under `commitStrategy: 'per-package'` a release is a sequence of independent pushes, so a commit landing on the release branch mid-run can interrupt it between packages. The orchestrator integrates the new tip and carries on with the packages that have not released yet, and packages already published are never republished, since their tags record them. Where semantic-release declines to release a package while the branch is moving underneath it, which is indistinguishable from that package genuinely having nothing to release, the package is released again against the integrated tip rather than assumed finished; a run that can never establish the answer fails rather than finishing as though the package had nothing, which would leave it and every package after it silently unreleased.
+
+One window is outside this tool's control: semantic-release pushes a package's tag before running its publish plugins, and that push is not atomic, so a rejection there can leave a tag on the remote for a version that never reached npm. Nothing is corrupted and no later release is blocked, but that version number is skipped. If it happens, find the tag with no matching published version (`npm view <name> versions`) and either publish from it by hand or delete the tag locally and on the remote and let the next run recompute it.
+
+If you need a run to be strictly all-or-nothing, use `commitStrategy: 'single'`, which makes one commit and one atomic push before anything publishes, and which retries the whole attempt against the new tip when that push loses a race.
+
 ## Gating publish
 
 `commitStrategy` changes how a release is committed; `gatePublish` changes *when* it gets published relative to being tagged and pushed -- a different, orthogonal axis. With `gatePublish: true`, each due package is tagged and pushed via [@exadev/release-gate](https://www.npmjs.com/package/@exadev/release-gate) (a real dependency of this package -- no separate install needed) but never published: nothing calls `npm publish`, creates a GitHub Release, or runs any other configured publish step, until a separate `resume` step does so explicitly -- from the same process, or a completely different one (a later CI job, once a deploy or smoke test has confirmed the release should actually go out).

package/dist/cli.js

@@ -14,7 +14,7 @@ import { generateNotes } from "@semantic-release/release-notes-generator";
 import semanticRelease from "semantic-release";
 import { pathToFileURL } from "node:url";
 //#region package.json
-var version = "3.0.0";
+var version = "3.0.2";
 //#endregion
 //#region src/errors.ts
 /**
@@ -279,6 +279,61 @@ async function pushHeadAndTags(tagNames, options) {
 		...tagNames
 	], options);
 }
+/**
+* Fetches `branch` from origin and returns the commit it now points at.
+*
+* This is how a failed push is classified, in preference to reading the reason git printed for the rejection. The wording is not stable enough to branch on: the same race produces `! [rejected] ... (non-fast-forward)` from one server and `cannot lock ref 'refs/heads/main': is at <x> but expected <y>` from another (both observed, the first against GitHub and the second against a local bare repository under `--atomic`), and neither is a documented interface. Whether the branch actually moved is a fact about the remote rather than a string, it is the precise condition a retry can recover from, and it is knowable by asking.
+*/
+async function fetchBranchTip(branch, options) {
+	await git([
+		"fetch",
+		"origin",
+		branch
+	], options);
+	return (await git(["rev-parse", "FETCH_HEAD"], options)).trim();
+}
+/** Whether `ancestor` is reachable from `descendant`. `git merge-base --is-ancestor` reports the answer as an exit status rather than on stdout: 0 for yes and 1 for no are both answers, so only any other exit code is a failure. */
+async function isAncestor(ancestor, descendant, options) {
+	const args = [
+		"merge-base",
+		"--is-ancestor",
+		ancestor,
+		descendant
+	];
+	try {
+		await execGit(args, options.cwd);
+		return true;
+	} catch (cause) {
+		const error = toGitCommandError(args, options.cwd, cause);
+		if (error.exitCode === 1) return false;
+		throw error;
+	}
+}
+/** Advances the current branch to `ref`, refusing unless that is a fast-forward. Used where every local commit is already on the remote, so anything that is not a fast-forward means the checkout holds work the remote does not, and stopping is better than the alternative of discarding it. */
+async function fastForwardTo(ref, options) {
+	await git([
+		"merge",
+		"--ff-only",
+		ref
+	], options);
+}
+/** Discards every commit and working-tree change the current attempt made, putting the checkout back on exactly `ref`. */
+async function resetHardTo(ref, options) {
+	await git([
+		"reset",
+		"--hard",
+		ref
+	], options);
+}
+/** Deletes local tags. A retried attempt must drop the tags its predecessor created before it recreates them: `git tag` refuses a name that already exists, so without this the second attempt fails while tagging, before it ever reaches the push it was retrying. */
+async function deleteLocalTags(tagNames, options) {
+	if (tagNames.length === 0) return;
+	await git([
+		"tag",
+		"-d",
+		...tagNames
+	], options);
+}
 function toGitCommandError(args, cwd, cause) {
 	const exitCode = cause instanceof Error && "code" in cause && typeof cause.code === "number" ? cause.code : void 0;
 	const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
@@ -887,6 +942,27 @@ async function regenerateLockfile(options) {
 * Why publish is not just another semantic-release() call: semantic-release's own `run()` unconditionally derives `lastRelease` from the newest tag already on the branch matching `tagFormat`, and this mode has, by the time phase 5 runs, already created and pushed that exact tag itself. A second real `semanticRelease()` call would see its own just-created tag as the already-published release and compute the wrong next version from it. Phase 5 instead calls each resolved plugin module's own exported `verifyConditions`/`publish`/`success` functions directly, with a hand-built context -- the same public per-plugin API surface semantic-release's own core calls internally, just invoked without going through the parts of `run()` that assume a not-yet-tagged repository.
 */
 async function releaseWorkspaceSingleCommit(options) {
+	const log = options.log ?? console.log;
+	const maxAttempts = resolvePushAttempts(options.pushAttempts);
+	let lastLoss;
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		const result = await attemptSingleCommitRelease(options);
+		if (result.kind === "complete") return result.outcome;
+		if (result.kind === "pushed") {
+			await result.publish();
+			return result.outcome;
+		}
+		lastLoss = result.error;
+		log(`${packageName}: attempt ${String(attempt)} of ${String(maxAttempts)} lost the push, because ${result.branch} advanced to ${result.remoteTip} before this run's own refs reached the remote. This attempt's commit and tags have been discarded; recomputing the release against the new tip.`);
+	}
+	throw new WorkspaceStateError(`${packageName}: gave up after ${String(maxAttempts)} attempt(s) to push the release, each overtaken by another commit landing on the release branch first. Nothing was published and no tag reached the remote, so re-running is safe and loses nothing. Raise "pushAttempts" if this branch is busy enough that ${String(maxAttempts)} is genuinely too few. The last push failed with: ${lastLoss === void 0 ? "unknown" : lastLoss.message}`);
+}
+function resolvePushAttempts(configured) {
+	if (configured === void 0) return 5;
+	if (!Number.isInteger(configured) || configured < 1) throw new ReleaseConfigurationError(`"pushAttempts" must be a positive integer; received ${String(configured)}.`);
+	return configured;
+}
+async function attemptSingleCommitRelease(options) {
 	const root = resolve(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
 	const dryRun = options.dryRun === true;
@@ -970,8 +1046,11 @@ async function releaseWorkspaceSingleCommit(options) {
 		}
 	}
 	if (dryRun || planned.length === 0) return {
-		order,
-		packages: outcomes
+		kind: "complete",
+		outcome: {
+			order,
+			packages: outcomes
+		}
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
@@ -1010,26 +1089,51 @@ async function releaseWorkspaceSingleCommit(options) {
 	const commitSha = (await git(["rev-parse", "HEAD"], { cwd: repoRoot })).trim();
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
-	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
-	for (const release of planned) {
-		const releases = [];
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.publish) {
-				const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
-				if (result !== false && result !== void 0) releases.push(result);
-			}
-		}
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+	const branchName = await currentBranch({ cwd: repoRoot });
+	try {
+		await pushHeadAndTags(tagNames, { cwd: repoRoot });
+	} catch (error) {
+		if (!(error instanceof GitCommandError)) throw error;
+		let remoteTip;
+		try {
+			remoteTip = await fetchBranchTip(branchName, { cwd: repoRoot });
+		} catch {
+			throw error;
 		}
-		log(`${release.pkg.name}: published ${release.gitTag}`);
+		if (await isAncestor(remoteTip, "HEAD", { cwd: repoRoot })) throw error;
+		await deleteLocalTags(tagNames, { cwd: repoRoot });
+		await resetHardTo(remoteTip, { cwd: repoRoot });
+		return {
+			kind: "lost",
+			error,
+			branch: branchName,
+			remoteTip
+		};
 	}
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	return {
-		order,
-		packages: outcomes
+		kind: "pushed",
+		outcome: {
+			order,
+			packages: outcomes
+		},
+		publish: async () => {
+			for (const release of planned) {
+				const releases = [];
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.publish) {
+						const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+						if (result !== false && result !== void 0) releases.push(result);
+					}
+				}
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+				}
+				log(`${release.pkg.name}: published ${release.gitTag}`);
+			}
+		}
 	};
 }
 /**
@@ -1237,7 +1341,7 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const { released, version, result } = await releaseOne(pkg, bumpsForThisPackage);
+		const { released, version, result } = await releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne);
 		entries.push({
 			name,
 			directory: pkg.directory,
@@ -1334,6 +1438,46 @@ async function bumpDependents(released, version, graph, options) {
 	}
 	return applied;
 }
+/**
+* How many times one package may be re-released after the branch moved underneath its own attempt, before the run gives up loudly.
+*
+* There is no option for this and no derivation from a measured rate, unlike `pushAttempts`, because the shape of the problem is different. Integration happens at most once per package boundary, so the loop is already bounded by the size of the workspace; this only bounds the pathological case where the branch moves during the same package's own attempt over and over. Each round costs one package's analysis, and a branch would have to move during three consecutive attempts at the same package to exhaust it, at which point the run is being starved rather than raced and saying so is more useful than trying again.
+*/
+const MAX_BRANCH_MOVES_PER_PACKAGE = 3;
+/**
+* Brings the checkout up to the release branch's current tip, and reports where that tip is.
+*
+* At a package boundary every commit this run has made is already on the remote (each release commit by `@semantic-release/git`'s own prepare push, each tag by semantic-release's own, each dependency bump by `pushHead`), so advancing onto a moved branch is a fast-forward and loses nothing. `fastForwardTo` refuses anything else rather than discarding local work, which would mean the assumption above had broken.
+*/
+async function integrateBranchTip(workspace, log) {
+	const cwd = workspace.root;
+	const branch = await currentBranch({ cwd });
+	const tip = await fetchBranchTip(branch, { cwd });
+	if (await isAncestor(tip, "HEAD", { cwd })) return tip;
+	if (!await isAncestor("HEAD", tip, { cwd })) throw new WorkspaceStateError(`${packageName}: ${branch} has moved to ${tip}, which this checkout has not and cannot reach by fast-forward, so the two have diverged. A release run expects every commit it has made to already be on the remote at this point; stopping rather than discarding whatever is here.`);
+	await fastForwardTo(tip, { cwd });
+	log(`${packageName}: ${branch} advanced to ${tip} during this run; integrated it before continuing.`);
+	return tip;
+}
+/**
+* Releases one package, integrating the release branch first and again whenever it moves under the attempt.
+*
+* This exists because semantic-release cannot tell the orchestrator the difference between the two reasons it declines to release. When the branch has moved since the run began, its `verifyAuth` fails, `isBranchUpToDate` reports the branch behind, and it returns the same "no release" the orchestrator gets for a package that genuinely had nothing to publish. Taking that at face value is how a run used to finish green having released only the packages that happened to come before the branch moved.
+*
+* The ambiguity is resolved by observation rather than by reading semantic-release's logs: if the branch did not move while the package was being released, "no release" is true. If it did, the answer is not trustworthy, so the branch is integrated and the package is released again against the new tip. That is safe to repeat because a package that really has nothing to release still has nothing after a fast-forward, and a package that does release is recorded by its tag, which every later run reads as the release having happened.
+*/
+async function releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne) {
+	if (dryRun) return await releaseOne(pkg, bumpsForThisPackage);
+	for (let moves = 0;; moves += 1) {
+		const tipBefore = await integrateBranchTip(workspace, log);
+		const outcome = await releaseOne(pkg, bumpsForThisPackage);
+		if (outcome.released) return outcome;
+		const tipAfter = await fetchBranchTip(await currentBranch({ cwd: workspace.root }), { cwd: workspace.root });
+		if (tipAfter === tipBefore) return outcome;
+		if (moves + 1 >= MAX_BRANCH_MOVES_PER_PACKAGE) throw new WorkspaceStateError(`${packageName}: ${name} reported no release ${String(moves + 1)} times, each time while the release branch was moving underneath it, so whether it had anything to release was never established. Failing rather than finishing the run as though it had nothing, which would leave this package and every one after it silently unreleased. Re-running once the branch is quieter is safe: packages that already released are recorded by their tags and are not released again.`);
+		log(`${name}: reported no release while the branch moved from ${tipBefore} to ${tipAfter}, which is also what a stale branch looks like; integrating and releasing it again.`);
+	}
+}
 //#endregion
 //#region src/gate-publish.ts
 /**

package/dist/index.cjs

@@ -286,6 +286,61 @@ async function pushHeadAndTags(tagNames, options) {
 		...tagNames
 	], options);
 }
+/**
+* Fetches `branch` from origin and returns the commit it now points at.
+*
+* This is how a failed push is classified, in preference to reading the reason git printed for the rejection. The wording is not stable enough to branch on: the same race produces `! [rejected] ... (non-fast-forward)` from one server and `cannot lock ref 'refs/heads/main': is at <x> but expected <y>` from another (both observed, the first against GitHub and the second against a local bare repository under `--atomic`), and neither is a documented interface. Whether the branch actually moved is a fact about the remote rather than a string, it is the precise condition a retry can recover from, and it is knowable by asking.
+*/
+async function fetchBranchTip(branch, options) {
+	await git([
+		"fetch",
+		"origin",
+		branch
+	], options);
+	return (await git(["rev-parse", "FETCH_HEAD"], options)).trim();
+}
+/** Whether `ancestor` is reachable from `descendant`. `git merge-base --is-ancestor` reports the answer as an exit status rather than on stdout: 0 for yes and 1 for no are both answers, so only any other exit code is a failure. */
+async function isAncestor(ancestor, descendant, options) {
+	const args = [
+		"merge-base",
+		"--is-ancestor",
+		ancestor,
+		descendant
+	];
+	try {
+		await execGit(args, options.cwd);
+		return true;
+	} catch (cause) {
+		const error = toGitCommandError(args, options.cwd, cause);
+		if (error.exitCode === 1) return false;
+		throw error;
+	}
+}
+/** Advances the current branch to `ref`, refusing unless that is a fast-forward. Used where every local commit is already on the remote, so anything that is not a fast-forward means the checkout holds work the remote does not, and stopping is better than the alternative of discarding it. */
+async function fastForwardTo(ref, options) {
+	await git([
+		"merge",
+		"--ff-only",
+		ref
+	], options);
+}
+/** Discards every commit and working-tree change the current attempt made, putting the checkout back on exactly `ref`. */
+async function resetHardTo(ref, options) {
+	await git([
+		"reset",
+		"--hard",
+		ref
+	], options);
+}
+/** Deletes local tags. A retried attempt must drop the tags its predecessor created before it recreates them: `git tag` refuses a name that already exists, so without this the second attempt fails while tagging, before it ever reaches the push it was retrying. */
+async function deleteLocalTags(tagNames, options) {
+	if (tagNames.length === 0) return;
+	await git([
+		"tag",
+		"-d",
+		...tagNames
+	], options);
+}
 function toGitCommandError(args, cwd, cause) {
 	const exitCode = cause instanceof Error && "code" in cause && typeof cause.code === "number" ? cause.code : void 0;
 	const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
@@ -900,6 +955,27 @@ function formatTagForPackage(tagFormat, name) {
 * Why publish is not just another semantic-release() call: semantic-release's own `run()` unconditionally derives `lastRelease` from the newest tag already on the branch matching `tagFormat`, and this mode has, by the time phase 5 runs, already created and pushed that exact tag itself. A second real `semanticRelease()` call would see its own just-created tag as the already-published release and compute the wrong next version from it. Phase 5 instead calls each resolved plugin module's own exported `verifyConditions`/`publish`/`success` functions directly, with a hand-built context -- the same public per-plugin API surface semantic-release's own core calls internally, just invoked without going through the parts of `run()` that assume a not-yet-tagged repository.
 */
 async function releaseWorkspaceSingleCommit(options) {
+	const log = options.log ?? console.log;
+	const maxAttempts = resolvePushAttempts(options.pushAttempts);
+	let lastLoss;
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		const result = await attemptSingleCommitRelease(options);
+		if (result.kind === "complete") return result.outcome;
+		if (result.kind === "pushed") {
+			await result.publish();
+			return result.outcome;
+		}
+		lastLoss = result.error;
+		log(`${packageName}: attempt ${String(attempt)} of ${String(maxAttempts)} lost the push, because ${result.branch} advanced to ${result.remoteTip} before this run's own refs reached the remote. This attempt's commit and tags have been discarded; recomputing the release against the new tip.`);
+	}
+	throw new WorkspaceStateError(`${packageName}: gave up after ${String(maxAttempts)} attempt(s) to push the release, each overtaken by another commit landing on the release branch first. Nothing was published and no tag reached the remote, so re-running is safe and loses nothing. Raise "pushAttempts" if this branch is busy enough that ${String(maxAttempts)} is genuinely too few. The last push failed with: ${lastLoss === void 0 ? "unknown" : lastLoss.message}`);
+}
+function resolvePushAttempts(configured) {
+	if (configured === void 0) return 5;
+	if (!Number.isInteger(configured) || configured < 1) throw new ReleaseConfigurationError(`"pushAttempts" must be a positive integer; received ${String(configured)}.`);
+	return configured;
+}
+async function attemptSingleCommitRelease(options) {
 	const root = (0, node_path.resolve)(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
 	const dryRun = options.dryRun === true;
@@ -983,8 +1059,11 @@ async function releaseWorkspaceSingleCommit(options) {
 		}
 	}
 	if (dryRun || planned.length === 0) return {
-		order,
-		packages: outcomes
+		kind: "complete",
+		outcome: {
+			order,
+			packages: outcomes
+		}
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
@@ -1023,26 +1102,51 @@ async function releaseWorkspaceSingleCommit(options) {
 	const commitSha = (await git(["rev-parse", "HEAD"], { cwd: repoRoot })).trim();
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
-	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
-	for (const release of planned) {
-		const releases = [];
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.publish) {
-				const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
-				if (result !== false && result !== void 0) releases.push(result);
-			}
-		}
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+	const branchName = await currentBranch({ cwd: repoRoot });
+	try {
+		await pushHeadAndTags(tagNames, { cwd: repoRoot });
+	} catch (error) {
+		if (!(error instanceof GitCommandError)) throw error;
+		let remoteTip;
+		try {
+			remoteTip = await fetchBranchTip(branchName, { cwd: repoRoot });
+		} catch {
+			throw error;
 		}
-		log(`${release.pkg.name}: published ${release.gitTag}`);
+		if (await isAncestor(remoteTip, "HEAD", { cwd: repoRoot })) throw error;
+		await deleteLocalTags(tagNames, { cwd: repoRoot });
+		await resetHardTo(remoteTip, { cwd: repoRoot });
+		return {
+			kind: "lost",
+			error,
+			branch: branchName,
+			remoteTip
+		};
 	}
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	return {
-		order,
-		packages: outcomes
+		kind: "pushed",
+		outcome: {
+			order,
+			packages: outcomes
+		},
+		publish: async () => {
+			for (const release of planned) {
+				const releases = [];
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.publish) {
+						const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+						if (result !== false && result !== void 0) releases.push(result);
+					}
+				}
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+				}
+				log(`${release.pkg.name}: published ${release.gitTag}`);
+			}
+		}
 	};
 }
 /**
@@ -1385,7 +1489,7 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const { released, version, result } = await releaseOne(pkg, bumpsForThisPackage);
+		const { released, version, result } = await releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne);
 		entries.push({
 			name,
 			directory: pkg.directory,
@@ -1482,6 +1586,46 @@ async function bumpDependents(released, version, graph, options) {
 	}
 	return applied;
 }
+/**
+* How many times one package may be re-released after the branch moved underneath its own attempt, before the run gives up loudly.
+*
+* There is no option for this and no derivation from a measured rate, unlike `pushAttempts`, because the shape of the problem is different. Integration happens at most once per package boundary, so the loop is already bounded by the size of the workspace; this only bounds the pathological case where the branch moves during the same package's own attempt over and over. Each round costs one package's analysis, and a branch would have to move during three consecutive attempts at the same package to exhaust it, at which point the run is being starved rather than raced and saying so is more useful than trying again.
+*/
+const MAX_BRANCH_MOVES_PER_PACKAGE = 3;
+/**
+* Brings the checkout up to the release branch's current tip, and reports where that tip is.
+*
+* At a package boundary every commit this run has made is already on the remote (each release commit by `@semantic-release/git`'s own prepare push, each tag by semantic-release's own, each dependency bump by `pushHead`), so advancing onto a moved branch is a fast-forward and loses nothing. `fastForwardTo` refuses anything else rather than discarding local work, which would mean the assumption above had broken.
+*/
+async function integrateBranchTip(workspace, log) {
+	const cwd = workspace.root;
+	const branch = await currentBranch({ cwd });
+	const tip = await fetchBranchTip(branch, { cwd });
+	if (await isAncestor(tip, "HEAD", { cwd })) return tip;
+	if (!await isAncestor("HEAD", tip, { cwd })) throw new WorkspaceStateError(`${packageName}: ${branch} has moved to ${tip}, which this checkout has not and cannot reach by fast-forward, so the two have diverged. A release run expects every commit it has made to already be on the remote at this point; stopping rather than discarding whatever is here.`);
+	await fastForwardTo(tip, { cwd });
+	log(`${packageName}: ${branch} advanced to ${tip} during this run; integrated it before continuing.`);
+	return tip;
+}
+/**
+* Releases one package, integrating the release branch first and again whenever it moves under the attempt.
+*
+* This exists because semantic-release cannot tell the orchestrator the difference between the two reasons it declines to release. When the branch has moved since the run began, its `verifyAuth` fails, `isBranchUpToDate` reports the branch behind, and it returns the same "no release" the orchestrator gets for a package that genuinely had nothing to publish. Taking that at face value is how a run used to finish green having released only the packages that happened to come before the branch moved.
+*
+* The ambiguity is resolved by observation rather than by reading semantic-release's logs: if the branch did not move while the package was being released, "no release" is true. If it did, the answer is not trustworthy, so the branch is integrated and the package is released again against the new tip. That is safe to repeat because a package that really has nothing to release still has nothing after a fast-forward, and a package that does release is recorded by its tag, which every later run reads as the release having happened.
+*/
+async function releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne) {
+	if (dryRun) return await releaseOne(pkg, bumpsForThisPackage);
+	for (let moves = 0;; moves += 1) {
+		const tipBefore = await integrateBranchTip(workspace, log);
+		const outcome = await releaseOne(pkg, bumpsForThisPackage);
+		if (outcome.released) return outcome;
+		const tipAfter = await fetchBranchTip(await currentBranch({ cwd: workspace.root }), { cwd: workspace.root });
+		if (tipAfter === tipBefore) return outcome;
+		if (moves + 1 >= MAX_BRANCH_MOVES_PER_PACKAGE) throw new WorkspaceStateError(`${packageName}: ${name} reported no release ${String(moves + 1)} times, each time while the release branch was moving underneath it, so whether it had anything to release was never established. Failing rather than finishing the run as though it had nothing, which would leave this package and every one after it silently unreleased. Re-running once the branch is quieter is safe: packages that already released are recorded by their tags and are not released again.`);
+		log(`${name}: reported no release while the branch moved from ${tipBefore} to ${tipAfter}, which is also what a stale branch looks like; integrating and releasing it again.`);
+	}
+}
 //#endregion
 exports.DEFAULT_PUBLISH_PLUGINS = DEFAULT_PUBLISH_PLUGINS;
 exports.DependencyCycleError = DependencyCycleError;

package/dist/index.d.cts

@@ -279,6 +279,14 @@ interface ReleaseWorkspaceOptions {
    * and pins `...@<action>-v1`. Validated once per run by `validateTagFormat`.
    */
   readonly tagFormat?: string;
+  /**
+   * How many times `commitStrategy: 'single'` will compute and push a release before giving up, when each attempt is lost to another commit landing on the release branch first. Defaults to `DEFAULT_PUSH_ATTEMPTS`. Ignored by `commitStrategy: 'per-package'`, which pushes incrementally and has no all-or-nothing attempt to repeat.
+   *
+   * The default is derived rather than chosen. An attempt is lost if any commit lands during its own window, so with pushes arriving at rate `L` and an attempt taking `W`, an attempt survives with probability `e^(-L*W)` and `n` attempts all fail with probability `(1 - e^(-L*W))^n`. On the busiest repository this tool serves, pushes to the release branch arrived at roughly one every 7.4 minutes while a merge queue was landing pull requests continuously (measured over the busiest 60, 90 and 120 minute windows, which agreed to within 6%), and analysing, preparing, committing and pushing 23 packages took about 2.2 minutes, so `W = 3` minutes leaves headroom for a larger workspace. That gives about a one-in-three chance of losing any single attempt, which matches what was observed when there was no retry at all, and 5 attempts put the chance of losing all of them near 0.4%, or roughly one lost release a month at ten releases a day. Five attempts also bound the added time at about 15 minutes, well inside the hour-long job timeouts these releases run under.
+   *
+   * Raise it for a busier branch or a slower workspace; the cost of a higher bound is only paid when attempts are actually being lost.
+   */
+  readonly pushAttempts?: number;
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {

package/dist/index.d.ts

@@ -279,6 +279,14 @@ interface ReleaseWorkspaceOptions {
    * and pins `...@<action>-v1`. Validated once per run by `validateTagFormat`.
    */
   readonly tagFormat?: string;
+  /**
+   * How many times `commitStrategy: 'single'` will compute and push a release before giving up, when each attempt is lost to another commit landing on the release branch first. Defaults to `DEFAULT_PUSH_ATTEMPTS`. Ignored by `commitStrategy: 'per-package'`, which pushes incrementally and has no all-or-nothing attempt to repeat.
+   *
+   * The default is derived rather than chosen. An attempt is lost if any commit lands during its own window, so with pushes arriving at rate `L` and an attempt taking `W`, an attempt survives with probability `e^(-L*W)` and `n` attempts all fail with probability `(1 - e^(-L*W))^n`. On the busiest repository this tool serves, pushes to the release branch arrived at roughly one every 7.4 minutes while a merge queue was landing pull requests continuously (measured over the busiest 60, 90 and 120 minute windows, which agreed to within 6%), and analysing, preparing, committing and pushing 23 packages took about 2.2 minutes, so `W = 3` minutes leaves headroom for a larger workspace. That gives about a one-in-three chance of losing any single attempt, which matches what was observed when there was no retry at all, and 5 attempts put the chance of losing all of them near 0.4%, or roughly one lost release a month at ten releases a day. Five attempts also bound the added time at about 15 minutes, well inside the hour-long job timeouts these releases run under.
+   *
+   * Raise it for a busier branch or a slower workspace; the cost of a higher bound is only paid when attempts are actually being lost.
+   */
+  readonly pushAttempts?: number;
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {

package/dist/index.js

@@ -261,6 +261,61 @@ async function pushHeadAndTags(tagNames, options) {
 		...tagNames
 	], options);
 }
+/**
+* Fetches `branch` from origin and returns the commit it now points at.
+*
+* This is how a failed push is classified, in preference to reading the reason git printed for the rejection. The wording is not stable enough to branch on: the same race produces `! [rejected] ... (non-fast-forward)` from one server and `cannot lock ref 'refs/heads/main': is at <x> but expected <y>` from another (both observed, the first against GitHub and the second against a local bare repository under `--atomic`), and neither is a documented interface. Whether the branch actually moved is a fact about the remote rather than a string, it is the precise condition a retry can recover from, and it is knowable by asking.
+*/
+async function fetchBranchTip(branch, options) {
+	await git([
+		"fetch",
+		"origin",
+		branch
+	], options);
+	return (await git(["rev-parse", "FETCH_HEAD"], options)).trim();
+}
+/** Whether `ancestor` is reachable from `descendant`. `git merge-base --is-ancestor` reports the answer as an exit status rather than on stdout: 0 for yes and 1 for no are both answers, so only any other exit code is a failure. */
+async function isAncestor(ancestor, descendant, options) {
+	const args = [
+		"merge-base",
+		"--is-ancestor",
+		ancestor,
+		descendant
+	];
+	try {
+		await execGit(args, options.cwd);
+		return true;
+	} catch (cause) {
+		const error = toGitCommandError(args, options.cwd, cause);
+		if (error.exitCode === 1) return false;
+		throw error;
+	}
+}
+/** Advances the current branch to `ref`, refusing unless that is a fast-forward. Used where every local commit is already on the remote, so anything that is not a fast-forward means the checkout holds work the remote does not, and stopping is better than the alternative of discarding it. */
+async function fastForwardTo(ref, options) {
+	await git([
+		"merge",
+		"--ff-only",
+		ref
+	], options);
+}
+/** Discards every commit and working-tree change the current attempt made, putting the checkout back on exactly `ref`. */
+async function resetHardTo(ref, options) {
+	await git([
+		"reset",
+		"--hard",
+		ref
+	], options);
+}
+/** Deletes local tags. A retried attempt must drop the tags its predecessor created before it recreates them: `git tag` refuses a name that already exists, so without this the second attempt fails while tagging, before it ever reaches the push it was retrying. */
+async function deleteLocalTags(tagNames, options) {
+	if (tagNames.length === 0) return;
+	await git([
+		"tag",
+		"-d",
+		...tagNames
+	], options);
+}
 function toGitCommandError(args, cwd, cause) {
 	const exitCode = cause instanceof Error && "code" in cause && typeof cause.code === "number" ? cause.code : void 0;
 	const stderr = cause instanceof Error && "stderr" in cause && typeof cause.stderr === "string" ? cause.stderr.trim() : "";
@@ -875,6 +930,27 @@ function formatTagForPackage(tagFormat, name) {
 * Why publish is not just another semantic-release() call: semantic-release's own `run()` unconditionally derives `lastRelease` from the newest tag already on the branch matching `tagFormat`, and this mode has, by the time phase 5 runs, already created and pushed that exact tag itself. A second real `semanticRelease()` call would see its own just-created tag as the already-published release and compute the wrong next version from it. Phase 5 instead calls each resolved plugin module's own exported `verifyConditions`/`publish`/`success` functions directly, with a hand-built context -- the same public per-plugin API surface semantic-release's own core calls internally, just invoked without going through the parts of `run()` that assume a not-yet-tagged repository.
 */
 async function releaseWorkspaceSingleCommit(options) {
+	const log = options.log ?? console.log;
+	const maxAttempts = resolvePushAttempts(options.pushAttempts);
+	let lastLoss;
+	for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+		const result = await attemptSingleCommitRelease(options);
+		if (result.kind === "complete") return result.outcome;
+		if (result.kind === "pushed") {
+			await result.publish();
+			return result.outcome;
+		}
+		lastLoss = result.error;
+		log(`${packageName}: attempt ${String(attempt)} of ${String(maxAttempts)} lost the push, because ${result.branch} advanced to ${result.remoteTip} before this run's own refs reached the remote. This attempt's commit and tags have been discarded; recomputing the release against the new tip.`);
+	}
+	throw new WorkspaceStateError(`${packageName}: gave up after ${String(maxAttempts)} attempt(s) to push the release, each overtaken by another commit landing on the release branch first. Nothing was published and no tag reached the remote, so re-running is safe and loses nothing. Raise "pushAttempts" if this branch is busy enough that ${String(maxAttempts)} is genuinely too few. The last push failed with: ${lastLoss === void 0 ? "unknown" : lastLoss.message}`);
+}
+function resolvePushAttempts(configured) {
+	if (configured === void 0) return 5;
+	if (!Number.isInteger(configured) || configured < 1) throw new ReleaseConfigurationError(`"pushAttempts" must be a positive integer; received ${String(configured)}.`);
+	return configured;
+}
+async function attemptSingleCommitRelease(options) {
 	const root = resolve(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
 	const dryRun = options.dryRun === true;
@@ -958,8 +1034,11 @@ async function releaseWorkspaceSingleCommit(options) {
 		}
 	}
 	if (dryRun || planned.length === 0) return {
-		order,
-		packages: outcomes
+		kind: "complete",
+		outcome: {
+			order,
+			packages: outcomes
+		}
 	};
 	const branch = captured.branch;
 	const repositoryUrl = captured.repositoryUrl;
@@ -998,26 +1077,51 @@ async function releaseWorkspaceSingleCommit(options) {
 	const commitSha = (await git(["rev-parse", "HEAD"], { cwd: repoRoot })).trim();
 	const tagNames = planned.map((release) => release.gitTag);
 	for (const tagName of tagNames) await createTag(tagName, commitSha, { cwd: repoRoot });
-	await pushHeadAndTags(tagNames, { cwd: repoRoot });
-	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
-	for (const release of planned) {
-		const releases = [];
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.publish) {
-				const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
-				if (result !== false && result !== void 0) releases.push(result);
-			}
-		}
-		for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
-			const plugin = await loadReleasePlugin(modulePath, moduleCache);
-			if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+	const branchName = await currentBranch({ cwd: repoRoot });
+	try {
+		await pushHeadAndTags(tagNames, { cwd: repoRoot });
+	} catch (error) {
+		if (!(error instanceof GitCommandError)) throw error;
+		let remoteTip;
+		try {
+			remoteTip = await fetchBranchTip(branchName, { cwd: repoRoot });
+		} catch {
+			throw error;
 		}
-		log(`${release.pkg.name}: published ${release.gitTag}`);
+		if (await isAncestor(remoteTip, "HEAD", { cwd: repoRoot })) throw error;
+		await deleteLocalTags(tagNames, { cwd: repoRoot });
+		await resetHardTo(remoteTip, { cwd: repoRoot });
+		return {
+			kind: "lost",
+			error,
+			branch: branchName,
+			remoteTip
+		};
 	}
+	log(`${packageName}: committed ${commitSha} and pushed ${String(tagNames.length)} tag(s): ${tagNames.join(", ")}`);
 	return {
-		order,
-		packages: outcomes
+		kind: "pushed",
+		outcome: {
+			order,
+			packages: outcomes
+		},
+		publish: async () => {
+			for (const release of planned) {
+				const releases = [];
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.publish) {
+						const result = await plugin.publish(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+						if (result !== false && result !== void 0) releases.push(result);
+					}
+				}
+				for (const [modulePath, pluginConfig] of mustGet(resolvedPlugins, release.pkg.name, "publish plugins")) {
+					const plugin = await loadReleasePlugin(modulePath, moduleCache);
+					if (plugin.success) await plugin.success(pluginConfig, buildPluginContext(release, shared, capturedCommits, releases));
+				}
+				log(`${release.pkg.name}: published ${release.gitTag}`);
+			}
+		}
 	};
 }
 /**
@@ -1360,7 +1464,7 @@ async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne)
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const { released, version, result } = await releaseOne(pkg, bumpsForThisPackage);
+		const { released, version, result } = await releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne);
 		entries.push({
 			name,
 			directory: pkg.directory,
@@ -1457,5 +1561,45 @@ async function bumpDependents(released, version, graph, options) {
 	}
 	return applied;
 }
+/**
+* How many times one package may be re-released after the branch moved underneath its own attempt, before the run gives up loudly.
+*
+* There is no option for this and no derivation from a measured rate, unlike `pushAttempts`, because the shape of the problem is different. Integration happens at most once per package boundary, so the loop is already bounded by the size of the workspace; this only bounds the pathological case where the branch moves during the same package's own attempt over and over. Each round costs one package's analysis, and a branch would have to move during three consecutive attempts at the same package to exhaust it, at which point the run is being starved rather than raced and saying so is more useful than trying again.
+*/
+const MAX_BRANCH_MOVES_PER_PACKAGE = 3;
+/**
+* Brings the checkout up to the release branch's current tip, and reports where that tip is.
+*
+* At a package boundary every commit this run has made is already on the remote (each release commit by `@semantic-release/git`'s own prepare push, each tag by semantic-release's own, each dependency bump by `pushHead`), so advancing onto a moved branch is a fast-forward and loses nothing. `fastForwardTo` refuses anything else rather than discarding local work, which would mean the assumption above had broken.
+*/
+async function integrateBranchTip(workspace, log) {
+	const cwd = workspace.root;
+	const branch = await currentBranch({ cwd });
+	const tip = await fetchBranchTip(branch, { cwd });
+	if (await isAncestor(tip, "HEAD", { cwd })) return tip;
+	if (!await isAncestor("HEAD", tip, { cwd })) throw new WorkspaceStateError(`${packageName}: ${branch} has moved to ${tip}, which this checkout has not and cannot reach by fast-forward, so the two have diverged. A release run expects every commit it has made to already be on the remote at this point; stopping rather than discarding whatever is here.`);
+	await fastForwardTo(tip, { cwd });
+	log(`${packageName}: ${branch} advanced to ${tip} during this run; integrated it before continuing.`);
+	return tip;
+}
+/**
+* Releases one package, integrating the release branch first and again whenever it moves under the attempt.
+*
+* This exists because semantic-release cannot tell the orchestrator the difference between the two reasons it declines to release. When the branch has moved since the run began, its `verifyAuth` fails, `isBranchUpToDate` reports the branch behind, and it returns the same "no release" the orchestrator gets for a package that genuinely had nothing to publish. Taking that at face value is how a run used to finish green having released only the packages that happened to come before the branch moved.
+*
+* The ambiguity is resolved by observation rather than by reading semantic-release's logs: if the branch did not move while the package was being released, "no release" is true. If it did, the answer is not trustworthy, so the branch is integrated and the package is released again against the new tip. That is safe to repeat because a package that really has nothing to release still has nothing after a fast-forward, and a package that does release is recorded by its tag, which every later run reads as the release having happened.
+*/
+async function releasePackageAcrossBranchMoves(name, pkg, bumpsForThisPackage, workspace, dryRun, log, releaseOne) {
+	if (dryRun) return await releaseOne(pkg, bumpsForThisPackage);
+	for (let moves = 0;; moves += 1) {
+		const tipBefore = await integrateBranchTip(workspace, log);
+		const outcome = await releaseOne(pkg, bumpsForThisPackage);
+		if (outcome.released) return outcome;
+		const tipAfter = await fetchBranchTip(await currentBranch({ cwd: workspace.root }), { cwd: workspace.root });
+		if (tipAfter === tipBefore) return outcome;
+		if (moves + 1 >= MAX_BRANCH_MOVES_PER_PACKAGE) throw new WorkspaceStateError(`${packageName}: ${name} reported no release ${String(moves + 1)} times, each time while the release branch was moving underneath it, so whether it had anything to release was never established. Failing rather than finishing the run as though it had nothing, which would leave this package and every one after it silently unreleased. Re-running once the branch is quieter is safe: packages that already released are recorded by their tags and are not released again.`);
+		log(`${name}: reported no release while the branch moved from ${tipBefore} to ${tipAfter}, which is also what a stale branch looks like; integrating and releasing it again.`);
+	}
+}
 //#endregion
 export { DEFAULT_PUBLISH_PLUGINS, DependencyCycleError, GitCommandError, ReleaseConfigurationError, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, UnsupportedDependencyRangeError, WorkspaceDiscoveryError, WorkspaceReleaseError, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, orderedPackages, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, resolveWorkspacePublishPlugins, resumeWorkspaceRelease, topologicalOrder, updateDependencyRange, writeDependencyRange };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exadev/semantic-release-workspace",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Independent per-package semantic-release orchestration for pnpm workspaces, without lockstep versioning.",
   "type": "module",
   "repository": {