@moku-labs/ci 1.0.0 → 1.1.2

package/README.md

@@ -43,9 +43,9 @@ registers the trusted publisher and applies the branch ruleset. Run it again any
 only does what is still missing.
 
 > [!NOTE]
-> **Status: `1.x`, early.** `package-ci.yml` runs on this repo's own PRs. `package-release.yml`
-> and the CLI's `setup` and `release` have passed dry-run and unit tests only; they have not
-> yet released a live package.
+> **Status: `1.x`, early.** `package-ci.yml`, `package-release.yml` and `moku-release release`
+> ship this package itself: `1.1.1` was the first live release, tokenless and with provenance.
+> `moku-release setup` has passed dry-run and unit tests only.
 
 > [!IMPORTANT]
 > Two steps are yours alone. The CLI never handles a credential, and there is no `NPM_TOKEN`
@@ -152,14 +152,26 @@ YAML stays the same for everyone.
 | `@v1.x.y` | Immutable tag on every change. Pin it to freeze a project. |
 | `@v2` | Any breaking change: a removed input, a changed default, a renamed job. `v1` stays where it was. |
 
+> [!IMPORTANT]
+> `v1` must be a **lightweight** tag. `package-release.yml` calls `./.github/workflows/package-ci.yml`
+> from inside itself, and GitHub cannot resolve that relative call through an annotated tag: every
+> release dies with `startup_failure` and "workflow was not found". Immutable `v1.x.y` tags may be
+> annotated.
+>
+> ```sh
+> git tag -a v1.2.0 -m "v1.2.0"
+> git tag -f v1 v1.2.0^{commit}      # no -a, no -m
+> git push origin v1.2.0 && git push -f origin v1
+> ```
+
 A change here runs in every moku repo with `contents: write` and `id-token: write`. Review it
 like release engineering, not like config.
 
 ## When a release fails
 
-One risk is still open: npm may reject a publish that runs inside a workflow owned by another
-repository. It is unverified until the first live release. The fallback and sixteen other
-traps the workflows already handle are in [docs/release-notes.md](docs/release-notes.md).
+The cross-repo OIDC publish was the open risk; npm accepted it on the first live release
+(`@moku-labs/ci@1.1.1`). The fallback, should npm ever change that, and sixteen traps the
+workflows already handle are in [docs/release-notes.md](docs/release-notes.md).
 
 ## Scripts
 

package/dist/release.mjs

@@ -1694,11 +1694,11 @@ async function runDoctor(options) {
 /** Workflow file dispatched by name — the same name npm's trusted publisher is bound to. */
 const PUBLISH_WORKFLOW_FILE = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
 /** How long to keep asking the registry for the new version before giving up. */
-const REGISTRY_POLL_ATTEMPTS = 24;
-/** Gap between registry polls — 24 × 5s ≈ two minutes of registry lag tolerated. */
-const REGISTRY_POLL_INTERVAL_MS = 5e3;
+const REGISTRY_POLL_ATTEMPTS = 60;
+/** Gap between registry polls — 60 × 10s = ten minutes. The first live release needed three. */
+const REGISTRY_POLL_INTERVAL_MS = 1e4;
 /** How many times to look for the dispatched run before concluding it never started. */
-const RUN_LOOKUP_ATTEMPTS = 10;
+const RUN_LOOKUP_ATTEMPTS = 20;
 /** Gap between run lookups — GitHub takes a moment to materialize a dispatched run. */
 const RUN_LOOKUP_INTERVAL_MS = 3e3;
 /**
@@ -1735,32 +1735,48 @@ async function preflight(ctx, ui) {
 	if (report.failed) ui.error("preflight failed — nothing was dispatched");
 	return !report.failed;
 }
+/** The `gh run list` call that names the newest `publish.yml` run on main. */
+const LATEST_RUN_ARGS = [
+	"run",
+	"list",
+	"--workflow",
+	PUBLISH_WORKFLOW_FILE,
+	"--branch",
+	"main",
+	"--limit",
+	"1",
+	"--json",
+	"databaseId"
+];
+/**
+* The newest `publish.yml` run right now. Read BEFORE the dispatch, it is the run the
+* dispatch must not be confused with.
+*
+* @param ctx - The ports and flags.
+* @returns The run id, or `undefined` when the workflow never ran.
+* @example
+* const previous = await newestRun(ctx);
+*/
+async function newestRun(ctx) {
+	const listing = await ctx.exec.capture("gh", LATEST_RUN_ARGS);
+	return listing.code === 0 ? latestRunId(listing.stdout) : void 0;
+}
 /**
-* Find the run the dispatch just created, retrying while GitHub materializes it.
+* Find the run the dispatch just created, retrying while GitHub materializes it. The
+* newest run is only ours once it differs from `previous`: asked too early, GitHub still
+* answers with the run of the release before.
 *
 * @param ctx - The ports and flags.
+* @param previous - The newest run id from before the dispatch.
 * @param sleep - The delay helper.
-* @returns The run id, or `undefined` when no run appeared.
+* @returns The run id, or `undefined` when no new run appeared.
 * @example
-* const runId = await findDispatchedRun(ctx, defaultSleep);
+* const runId = await findDispatchedRun(ctx, previous, defaultSleep);
 */
-async function findDispatchedRun(ctx, sleep) {
-	const args = [
-		"run",
-		"list",
-		"--workflow",
-		PUBLISH_WORKFLOW_FILE,
-		"--branch",
-		"main",
-		"--limit",
-		"1",
-		"--json",
-		"databaseId"
-	];
+async function findDispatchedRun(ctx, previous, sleep) {
 	for (let attempt = 0; attempt < RUN_LOOKUP_ATTEMPTS; attempt += 1) {
-		const listing = await ctx.exec.capture("gh", args);
-		const runId = listing.code === 0 ? latestRunId(listing.stdout) : void 0;
-		if (runId !== void 0) return runId;
+		const runId = await newestRun(ctx);
+		if (runId !== void 0 && runId !== previous) return runId;
 		await sleep(RUN_LOOKUP_INTERVAL_MS);
 	}
 }
@@ -1854,6 +1870,7 @@ async function runRelease(options) {
 		return 0;
 	}
 	ui.heading("Dispatch");
+	const previousRun = await newestRun(ctx);
 	const dispatched = await ctx.exec.capture("gh", [
 		"workflow",
 		"run",
@@ -1868,7 +1885,7 @@ async function runRelease(options) {
 		return 1;
 	}
 	ui.check(true, `${PUBLISH_WORKFLOW_FILE} dispatched (${releaseType})`);
-	const runId = await findDispatchedRun(ctx, sleep);
+	const runId = await findDispatchedRun(ctx, previousRun, sleep);
 	if (runId === void 0) {
 		ui.error("the dispatched run never appeared — check GitHub Actions");
 		return 1;
@@ -1886,7 +1903,7 @@ async function runRelease(options) {
 	ui.heading("Registry");
 	const version = await awaitPublishedVersion(ctx, manifest.name, tag, before, sleep);
 	if (version === void 0) {
-		ui.error(`npm dist-tag \`${tag}\` did not move — the run passed but nothing was published`);
+		ui.error(`npm dist-tag \`${tag}\` did not move in ten minutes — the run passed, so check \`npm view ${manifest.name} dist-tags\` before releasing again`);
 		return 1;
 	}
 	renderSummary(ui, manifest.name, version, ownerRepo);
@@ -2261,21 +2278,23 @@ function parseArgv(argv) {
 /** Exit code POSIX shells use for "command not found" — what a missing binary reports. */
 const COMMAND_NOT_FOUND = 127;
 /**
-* Normalize whatever `execFile` rejected with into a {@link CommandOutput}. A non-zero exit
-* carries `code` plus both streams; a missing binary carries an `ENOENT`-style string code
-* and no exit status at all.
+* Normalize a failed `execFile` call into a {@link CommandOutput}. A non-zero exit carries
+* `code` and both streams; a missing binary carries an `ENOENT`-style string code, no exit
+* status and no output, so the error text stands in for stderr.
 *
-* @param error - The rejection value from `execFile`.
+* @param error - The error `execFile` passed to its callback.
+* @param stdout - What the child wrote to stdout before it failed.
+* @param stderr - What the child wrote to stderr before it failed.
 * @returns The equivalent captured output.
 * @example
-* fromExecError({ code: 1, stdout: "", stderr: "not logged in" });
+* fromExecError({ code: 1 }, "", "not logged in");
 */
-function fromExecError(error) {
+function fromExecError(error, stdout, stderr) {
 	const shape = error;
 	return {
 		code: typeof shape.code === "number" ? shape.code : COMMAND_NOT_FOUND,
-		stdout: shape.stdout ?? "",
-		stderr: shape.stderr ?? String(error)
+		stdout,
+		stderr: stderr === "" && stdout === "" ? String(error) : stderr
 	};
 }
 /**
@@ -2300,7 +2319,7 @@ function createExecutor(cwd) {
 	*/
 	const capture = (command, args, options = {}) => new Promise((resolve) => {
 		const child = execFile(command, [...args], { cwd: options.cwd ?? cwd }, (error, stdout, stderr) => {
-			if (error) return resolve(fromExecError(error));
+			if (error) return resolve(fromExecError(error, stdout, stderr));
 			resolve({
 				code: 0,
 				stdout,

package/package.json

@@ -1,13 +1,22 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.0.0",
+  "version": "1.1.2",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
-  "sideEffects": ["./dist/release.mjs", "./src/index.ts"],
+  "sideEffects": [
+    "./dist/release.mjs",
+    "./src/index.ts"
+  ],
   "bin": {
     "moku-release": "./dist/release.mjs"
   },
-  "files": ["dist", "examples", "rulesets", "LICENSE", "README.md"],
+  "files": [
+    "dist",
+    "examples",
+    "rulesets",
+    "LICENSE",
+    "README.md"
+  ],
   "engines": {
     "node": ">=24.0.0",
     "bun": ">=1.3.14"