@moku-labs/ci 1.1.1 → 1.1.3

package/README.md

@@ -43,9 +43,9 @@ registers the trusted publisher and applies the branch ruleset. Run it again any
 only does what is still missing.
 
 > [!NOTE]
-> **Status: `1.x`, early.** `package-ci.yml` runs on this repo's own PRs. `package-release.yml`
-> and the CLI's `setup` and `release` have passed dry-run and unit tests only; they have not
-> yet released a live package.
+> **Status: `1.x`, early.** `package-ci.yml`, `package-release.yml` and `moku-release release`
+> ship this package itself: `1.1.1` was the first live release, tokenless and with provenance.
+> `moku-release setup` has passed dry-run and unit tests only.
 
 > [!IMPORTANT]
 > Two steps are yours alone. The CLI never handles a credential, and there is no `NPM_TOKEN`
@@ -114,7 +114,7 @@ flowchart LR
 | Command | When | What it does |
 |---|---|---|
 | `bun run release:setup` | once per project | Idempotent wizard: workflows, script contract, first publish, first tag, trusted publisher, branch ruleset, then `doctor`. `--dry-run` prints every action and changes nothing. |
-| `bun run release:doctor` | any time | Read-only. Eleven checks, one line each, and the exact `fix:` command for every red line. `--json` for machines. |
+| `bun run release:doctor` | any time | Changes nothing in the project; it only runs `git fetch --tags` first. Eleven checks, one line each, and the exact `fix:` command for every red line. `--json` for machines. |
 | `bun run release <patch\|minor\|major\|prerelease>` | each release | Refuses unless the tree is clean and `HEAD == origin/main`. Dispatches `publish.yml`, watches the run, verifies the version and dist-tag on npm. |
 
 The scripts are plain aliases of the `moku-release` bin. Internals and the list of checks:
@@ -152,14 +152,26 @@ YAML stays the same for everyone.
 | `@v1.x.y` | Immutable tag on every change. Pin it to freeze a project. |
 | `@v2` | Any breaking change: a removed input, a changed default, a renamed job. `v1` stays where it was. |
 
+> [!IMPORTANT]
+> `v1` must be a **lightweight** tag. `package-release.yml` calls `./.github/workflows/package-ci.yml`
+> from inside itself, and GitHub cannot resolve that relative call through an annotated tag: every
+> release dies with `startup_failure` and "workflow was not found". Immutable `v1.x.y` tags may be
+> annotated.
+>
+> ```sh
+> git tag -a v1.2.0 -m "v1.2.0"
+> git tag -f v1 v1.2.0^{commit}      # no -a, no -m
+> git push origin v1.2.0 && git push -f origin v1
+> ```
+
 A change here runs in every moku repo with `contents: write` and `id-token: write`. Review it
 like release engineering, not like config.
 
 ## When a release fails
 
-One risk is still open: npm may reject a publish that runs inside a workflow owned by another
-repository. It is unverified until the first live release. The fallback and sixteen other
-traps the workflows already handle are in [docs/release-notes.md](docs/release-notes.md).
+The cross-repo OIDC publish was the open risk; npm accepted it on the first live release
+(`@moku-labs/ci@1.1.1`). The fallback, should npm ever change that, and sixteen traps the
+workflows already handle are in [docs/release-notes.md](docs/release-notes.md).
 
 ## Scripts
 

package/dist/release.mjs

@@ -1671,6 +1671,11 @@ async function evaluate(check, ctx) {
 async function runDoctor(options) {
 	const { ctx, ui, json = false, checks = allChecks } = options;
 	const entries = [];
+	await ctx.exec.capture("git", [
+		"fetch",
+		"--tags",
+		"--prune"
+	]);
 	for (const check of checks) entries.push(await evaluate(check, ctx));
 	const failed = entries.some((entry) => entry.status === "fail");
 	if (json) {
@@ -1694,11 +1699,11 @@ async function runDoctor(options) {
 /** Workflow file dispatched by name — the same name npm's trusted publisher is bound to. */
 const PUBLISH_WORKFLOW_FILE = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
 /** How long to keep asking the registry for the new version before giving up. */
-const REGISTRY_POLL_ATTEMPTS = 24;
-/** Gap between registry polls — 24 × 5s ≈ two minutes of registry lag tolerated. */
-const REGISTRY_POLL_INTERVAL_MS = 5e3;
+const REGISTRY_POLL_ATTEMPTS = 60;
+/** Gap between registry polls — 60 × 10s = ten minutes. The first live release needed three. */
+const REGISTRY_POLL_INTERVAL_MS = 1e4;
 /** How many times to look for the dispatched run before concluding it never started. */
-const RUN_LOOKUP_ATTEMPTS = 10;
+const RUN_LOOKUP_ATTEMPTS = 20;
 /** Gap between run lookups — GitHub takes a moment to materialize a dispatched run. */
 const RUN_LOOKUP_INTERVAL_MS = 3e3;
 /**
@@ -1735,32 +1740,48 @@ async function preflight(ctx, ui) {
 	if (report.failed) ui.error("preflight failed — nothing was dispatched");
 	return !report.failed;
 }
+/** The `gh run list` call that names the newest `publish.yml` run on main. */
+const LATEST_RUN_ARGS = [
+	"run",
+	"list",
+	"--workflow",
+	PUBLISH_WORKFLOW_FILE,
+	"--branch",
+	"main",
+	"--limit",
+	"1",
+	"--json",
+	"databaseId"
+];
+/**
+* The newest `publish.yml` run right now. Read BEFORE the dispatch, it is the run the
+* dispatch must not be confused with.
+*
+* @param ctx - The ports and flags.
+* @returns The run id, or `undefined` when the workflow never ran.
+* @example
+* const previous = await newestRun(ctx);
+*/
+async function newestRun(ctx) {
+	const listing = await ctx.exec.capture("gh", LATEST_RUN_ARGS);
+	return listing.code === 0 ? latestRunId(listing.stdout) : void 0;
+}
 /**
-* Find the run the dispatch just created, retrying while GitHub materializes it.
+* Find the run the dispatch just created, retrying while GitHub materializes it. The
+* newest run is only ours once it differs from `previous`: asked too early, GitHub still
+* answers with the run of the release before.
 *
 * @param ctx - The ports and flags.
+* @param previous - The newest run id from before the dispatch.
 * @param sleep - The delay helper.
-* @returns The run id, or `undefined` when no run appeared.
+* @returns The run id, or `undefined` when no new run appeared.
 * @example
-* const runId = await findDispatchedRun(ctx, defaultSleep);
+* const runId = await findDispatchedRun(ctx, previous, defaultSleep);
 */
-async function findDispatchedRun(ctx, sleep) {
-	const args = [
-		"run",
-		"list",
-		"--workflow",
-		PUBLISH_WORKFLOW_FILE,
-		"--branch",
-		"main",
-		"--limit",
-		"1",
-		"--json",
-		"databaseId"
-	];
+async function findDispatchedRun(ctx, previous, sleep) {
 	for (let attempt = 0; attempt < RUN_LOOKUP_ATTEMPTS; attempt += 1) {
-		const listing = await ctx.exec.capture("gh", args);
-		const runId = listing.code === 0 ? latestRunId(listing.stdout) : void 0;
-		if (runId !== void 0) return runId;
+		const runId = await newestRun(ctx);
+		if (runId !== void 0 && runId !== previous) return runId;
 		await sleep(RUN_LOOKUP_INTERVAL_MS);
 	}
 }
@@ -1832,11 +1853,6 @@ async function runRelease(options) {
 		ui.error("package.json is missing, malformed, or has no `name`");
 		return 1;
 	}
-	await ctx.exec.capture("git", [
-		"fetch",
-		"--tags",
-		"--prune"
-	]);
 	if (!await preflight(ctx, ui)) return 1;
 	const declared = repositoryUrlOf(manifest);
 	const ownerRepo = declared === void 0 ? void 0 : ownerRepoFrom(declared);
@@ -1854,6 +1870,7 @@ async function runRelease(options) {
 		return 0;
 	}
 	ui.heading("Dispatch");
+	const previousRun = await newestRun(ctx);
 	const dispatched = await ctx.exec.capture("gh", [
 		"workflow",
 		"run",
@@ -1868,7 +1885,7 @@ async function runRelease(options) {
 		return 1;
 	}
 	ui.check(true, `${PUBLISH_WORKFLOW_FILE} dispatched (${releaseType})`);
-	const runId = await findDispatchedRun(ctx, sleep);
+	const runId = await findDispatchedRun(ctx, previousRun, sleep);
 	if (runId === void 0) {
 		ui.error("the dispatched run never appeared — check GitHub Actions");
 		return 1;
@@ -1886,7 +1903,7 @@ async function runRelease(options) {
 	ui.heading("Registry");
 	const version = await awaitPublishedVersion(ctx, manifest.name, tag, before, sleep);
 	if (version === void 0) {
-		ui.error(`npm dist-tag \`${tag}\` did not move — the run passed but nothing was published`);
+		ui.error(`npm dist-tag \`${tag}\` did not move in ten minutes — the run passed, so check \`npm view ${manifest.name} dist-tags\` before releasing again`);
 		return 1;
 	}
 	renderSummary(ui, manifest.name, version, ownerRepo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [