Skip to content

docs(releasing): document trusted publisher expiry and failed-job reruns - #24

Open
TheStreamCode wants to merge 2 commits into
mainfrom
thestreamcode-codebase-brief-ci-investigation
Open

TheStreamCode wants to merge 2 commits into
mainfrom
thestreamcode-codebase-brief-ci-investigation

Conversation

@TheStreamCode

Copy link
Copy Markdown
Owner

Summary

The v2.0.11 Package release run failed in Publish npm packages with E404 on the first native package. The seven trusted publisher entries were in place by 2026-11-04 but were first used on 2026-11-09; npm requires a new configuration to complete its first publish within two days, after which it expires and can only be deleted and recreated.

This change records that failure mode and the two timing rules behind it in docs/releasing.md:

  • a two-day window to validate a new trusted publisher, with the npm trust list / revoke / github commands to recreate an expired entry;
  • a multi-hour propagation window after recreation, which npm reports as the same E404;
  • guidance to re-run only the failed jobs while the six native artifacts are still inside their seven-day retention.

The section that previously said a 404 "still means the trusted publisher is missing, mis-scoped, or attached to a different workflow or environment" now also names expiry, which is what this release hit.

Verification

  • I ran the narrowest relevant tests and listed them below.
  • I updated documentation for user-visible or operational changes.
  • I did not add credentials, private data, telemetry, or unreviewed network calls.
  • I preserved upstream and third-party license notices.

Commands and results:

git diff --check
  exit 0, no whitespace errors

The Docs workflow does not lint docs/releasing.md (it covers README.md,
CONTRIBUTING.md, SECURITY.md, SUPPORT.md, CODE_OF_CONDUCT.md), so no
markdownlint run applies to this file.

Code and workflow behavior unchanged: no Rust or npm source was modified.

The release failure itself was re-run from this worktree with gh run rerun 42527935919 --failed; the publish job reproduced the same E404 on chutes-build-darwin-arm64, which is why the fix is on npm's side (recreate the trusted publishers) plus this documentation.

Privacy and compatibility

None. Documentation only; no local data, outbound requests, permissions, supported platforms, model routing, or fallback behavior changed.

The v2.0.11 package release failed its npm publish step with E404 on the
first native package. The trusted publisher entries were in place by
4 November but were first used on 9 November, past npm's two-day window for
a configuration to complete its first publish.

Record the two timing rules that decide whether an otherwise correct entry
works (two-day validation, multi-hour propagation), the commands to rebuild
an expired entry, and the practice of re-running only the failed jobs while
the native artifacts are still inside their seven-day retention.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant