Repository navigation
docs(releasing): document trusted publisher expiry and failed-job reruns - #24
Open
TheStreamCode wants to merge 2 commits into
Open
TheStreamCode wants to merge 2 commits into
TheStreamCode wants to merge 2 commits into
Conversation
The v2.0.11 package release failed its npm publish step with E404 on the first native package. The trusted publisher entries were in place by 4 November but were first used on 9 November, past npm's two-day window for a configuration to complete its first publish. Record the two timing rules that decide whether an otherwise correct entry works (two-day validation, multi-hour propagation), the commands to rebuild an expired entry, and the practice of re-running only the failed jobs while the native artifacts are still inside their seven-day retention.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The v2.0.11
Package releaserun failed inPublish npm packageswithE404on the first native package. The seven trusted publisher entries were in place by 2026-11-04 but were first used on 2026-11-09; npm requires a new configuration to complete its first publish within two days, after which it expires and can only be deleted and recreated.This change records that failure mode and the two timing rules behind it in
docs/releasing.md:npm trust list/revoke/githubcommands to recreate an expired entry;E404;The section that previously said a
404"still means the trusted publisher is missing, mis-scoped, or attached to a different workflow or environment" now also names expiry, which is what this release hit.Verification
Commands and results:
The release failure itself was re-run from this worktree with
gh run rerun 42527935919 --failed; the publish job reproduced the sameE404onchutes-build-darwin-arm64, which is why the fix is on npm's side (recreate the trusted publishers) plus this documentation.Privacy and compatibility
None. Documentation only; no local data, outbound requests, permissions, supported platforms, model routing, or fallback behavior changed.