pi-widget-host 0.3.2 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -0
- package/README.md +1 -0
- package/docs/npm-publish-run-2026-07-04.md +118 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,13 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## Unreleased
|
|
4
|
+
|
|
5
|
+
### Changed
|
|
6
|
+
|
|
7
|
+
- Bump package version to `0.3.4` for the next patch release.
|
|
8
|
+
|
|
9
|
+
- Add Buy Me a Coffee sponsor button to README and native GitHub funding link via `.github/FUNDING.yml`.
|
|
10
|
+
|
|
3
11
|
All notable changes to this project will be documented in this file.
|
|
4
12
|
|
|
5
13
|
This project follows semantic versioning.
|
|
@@ -42,3 +50,4 @@ This project follows semantic versioning.
|
|
|
42
50
|
### Changed
|
|
43
51
|
|
|
44
52
|
- Replaced template placeholders and removed template-only skill, prompt, and theme resources.
|
|
53
|
+
|
package/README.md
CHANGED
|
@@ -7,6 +7,7 @@
|
|
|
7
7
|
[](LICENSE)
|
|
8
8
|
[](https://pi.dev/packages)
|
|
9
9
|
[](docs/release.md)
|
|
10
|
+
<a href="https://buymeacoffee.com/ekawano114m"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" width="217" height="60"></a>
|
|
10
11
|
|
|
11
12
|
> Shared-slot host for managing one prompt-top Pi widget across multiple providers.
|
|
12
13
|
|
|
@@ -0,0 +1,118 @@
|
|
|
1
|
+
# 2026-07-04 npm publish failure investigation
|
|
2
|
+
|
|
3
|
+
This records the failed `Publish to npm` workflow run without changing release workflows,
|
|
4
|
+
package versions, changelog entries, npm registry state, or releases.
|
|
5
|
+
|
|
6
|
+
## Failed run
|
|
7
|
+
|
|
8
|
+
- Run: <https://github.com/eiei114/pi-widget-host/actions/runs/28704568448>
|
|
9
|
+
- Workflow: `Publish to npm` (`.github/workflows/publish.yml`)
|
|
10
|
+
- Event: `workflow_dispatch`
|
|
11
|
+
- Selected ref / head branch: `v0.3.3`
|
|
12
|
+
- Checked-out object: tag `v0.3.3` -> commit `b7907bc48a57900b7e466a18e6a681184dcda797`
|
|
13
|
+
- Run attempt: `1`
|
|
14
|
+
- Started: `2026-07-04T11:20:24Z`
|
|
15
|
+
- Completed: `2026-07-04T11:20:56Z`
|
|
16
|
+
- Conclusion: `failure`
|
|
17
|
+
|
|
18
|
+
## Package and npm public state
|
|
19
|
+
|
|
20
|
+
- Package name at the failed ref: `pi-widget-host`
|
|
21
|
+
- Package version at the failed ref: `0.3.3`
|
|
22
|
+
- Current public npm state: `pi-widget-host@0.3.3` exists and is the `latest` dist-tag.
|
|
23
|
+
- `npm view pi-widget-host@0.3.3 version dist-tags time --json` reported:
|
|
24
|
+
- version: `0.3.3`
|
|
25
|
+
- latest: `0.3.3`
|
|
26
|
+
- `0.3.3` publish time: `2026-07-04T11:20:45.499Z`
|
|
27
|
+
|
|
28
|
+
## Failure output
|
|
29
|
+
|
|
30
|
+
The failed run validated and packed `pi-widget-host@0.3.3`, then the pre-publish guard
|
|
31
|
+
printed `Publishing pi-widget-host@0.3.3.` and allowed `npm publish --access public` to run.
|
|
32
|
+
The publish step failed with:
|
|
33
|
+
|
|
34
|
+
```text
|
|
35
|
+
npm error You cannot publish over the previously published versions: 0.3.3.
|
|
36
|
+
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-07-04T11_20_52_501Z-debug-0.log
|
|
37
|
+
Error: Process completed with exit code 1.
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
A concurrent successful run explains why the guard saw the version as unpublished but the
|
|
41
|
+
publish step then hit a duplicate version:
|
|
42
|
+
|
|
43
|
+
- Successful run: <https://github.com/eiei114/pi-widget-host/actions/runs/28704565106>
|
|
44
|
+
- Event/ref: `push` on `main`
|
|
45
|
+
- Commit: `b7907bc48a57900b7e466a18e6a681184dcda797`
|
|
46
|
+
- Started: `2026-07-04T11:20:16Z`
|
|
47
|
+
- `Publish to npm` step ran from `2026-07-04T11:20:42Z` to `2026-07-04T11:20:46Z`
|
|
48
|
+
- npm records `0.3.3` as published at `2026-07-04T11:20:45.499Z`
|
|
49
|
+
- The failed manual run's duplicate-version error occurred at `2026-07-04T11:20:54Z`
|
|
50
|
+
|
|
51
|
+
## Cause classification
|
|
52
|
+
|
|
53
|
+
Classification: **duplicate-version**.
|
|
54
|
+
|
|
55
|
+
The duplicate was caused by overlapping publish-eligible workflow runs for the same package
|
|
56
|
+
version. The automatic `push` run published `0.3.3`; the manual `workflow_dispatch` run on
|
|
57
|
+
`v0.3.3` reached `npm publish` seconds later and npm rejected publishing over an existing
|
|
58
|
+
version.
|
|
59
|
+
|
|
60
|
+
This is not currently classified as Trusted Publishing/authentication. The failed run had
|
|
61
|
+
`id-token: write`, installed a trusted-publishing-capable npm, and reached npm's duplicate
|
|
62
|
+
version validation rather than failing for provenance, OIDC, token, or permission reasons.
|
|
63
|
+
|
|
64
|
+
## Current workflow behavior
|
|
65
|
+
|
|
66
|
+
Current `.github/workflows/publish.yml` still allows multiple trigger paths to publish:
|
|
67
|
+
|
|
68
|
+
- `push` to `main` when package or workflow files change
|
|
69
|
+
- tag pushes matching `v*.*.*`
|
|
70
|
+
- published GitHub releases
|
|
71
|
+
- manual `workflow_dispatch` with an optional `ref`
|
|
72
|
+
|
|
73
|
+
The workflow has a duplicate-version guard using `npm view "${name}@${version}" version` and
|
|
74
|
+
skips only when that query succeeds before the publish step. It is useful for already-published
|
|
75
|
+
versions, but it is not an atomic lock: another run can publish the same version after the guard
|
|
76
|
+
checks and before `npm publish` runs.
|
|
77
|
+
|
|
78
|
+
The concurrency group is `npm-publish-${{ github.event.inputs.ref || github.ref }}`. For the
|
|
79
|
+
2026-07-04 overlap, the automatic run used a `main` ref while the manual run used `v0.3.3`, so
|
|
80
|
+
those two runs did not share a concurrency group even though both targeted `pi-widget-host@0.3.3`.
|
|
81
|
+
|
|
82
|
+
## Reproducible non-publish check
|
|
83
|
+
|
|
84
|
+
Use these read-only commands to reproduce the investigation without publishing:
|
|
85
|
+
|
|
86
|
+
```bash
|
|
87
|
+
gh run view 28704568448 \
|
|
88
|
+
--json event,headBranch,headSha,createdAt,updatedAt,conclusion,status,workflowName,url,jobs
|
|
89
|
+
|
|
90
|
+
gh run view 28704568448 --log-failed
|
|
91
|
+
|
|
92
|
+
gh run view 28704565106 \
|
|
93
|
+
--json event,headBranch,headSha,createdAt,updatedAt,conclusion,status,workflowName,url,jobs
|
|
94
|
+
|
|
95
|
+
npm view pi-widget-host@0.3.3 version dist-tags time --json
|
|
96
|
+
|
|
97
|
+
node -p "require('./package.json').name + '@' + require('./package.json').version"
|
|
98
|
+
npm pack --dry-run
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
`npm pack --dry-run` exercises package assembly only; it does not publish.
|
|
102
|
+
|
|
103
|
+
## Smallest safe correction options
|
|
104
|
+
|
|
105
|
+
No correction is applied in this investigation slice. Safe follow-up options, from smallest to
|
|
106
|
+
more opinionated, are:
|
|
107
|
+
|
|
108
|
+
1. Treat npm duplicate-version failures as a successful no-op when a post-failure `npm view
|
|
109
|
+
"${name}@${version}" version` confirms the same version is public. This preserves all current
|
|
110
|
+
triggers and makes publish races idempotent.
|
|
111
|
+
2. Change the concurrency group to a package-version-derived value after checkout, or otherwise
|
|
112
|
+
serialize all publish attempts that target the same `package.json` version. GitHub workflow-level
|
|
113
|
+
concurrency cannot directly read `package.json`, so this likely needs a small pre-publish lock
|
|
114
|
+
design rather than only editing the existing top-level group.
|
|
115
|
+
3. Reduce publish trigger overlap by making one path authoritative, such as publishing only from
|
|
116
|
+
release/tag events and keeping manual dispatch for recovery after maintainer review.
|
|
117
|
+
|
|
118
|
+
Any follow-up should remain release-owner approved because it changes release workflow behavior.
|
package/package.json
CHANGED