From 0a884ce83b62c06a1bfa81de83bd707bcd5ab634 Mon Sep 17 00:00:00 2001
From: Justin Murray <justin@tigerdata.com>
Date: Tue, 4 Aug 2026 15:38:36 -0400
Subject: [PATCH] fix(ci): build the example before the private-registry
 publish step
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The example install failed with:

  error Error: Failed to replace env in config: ${NODE_AUTH_TOKEN}

`setup-node` writes an .npmrc, and exports NPM_CONFIG_USERCONFIG pointing at
it, only when given `registry-url` — and it never unsets that for later steps.
That .npmrc always contains a literal `_authToken=${NODE_AUTH_TOKEN}`. Up
through v4 the action also exported a dummy token when none was supplied, so
the placeholder always resolved; v7 removed that fallback
(actions/setup-node#1558). npm tolerates the unresolved placeholder but yarn v1
hard-errors on it, so the reset-to-public-registry step could not work: any
`registry-url` step leaves an .npmrc that breaks a later bare `yarn`.

Order the example install and build before both publish steps instead, so they
run with no .npmrc at all on the default public registry. This also makes the
release fail fast: publishing is irreversible, so a broken example should stop
the release rather than leave a published package with no matching Pages
deploy.

Also use `--frozen-lockfile` for both installs so a release can't silently
resolve dependencies that differ from the committed lockfiles.
---
 .github/workflows/publish.yml | 46 +++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e60adb5..46d5995 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
       - name: Upgrade npm
         run: npm install -g npm@latest
 
-      - run: yarn
+      - run: yarn install --frozen-lockfile
       - run: yarn build
 
       - run: yarn version --no-git-tag-version --new-version ${{ github.event.release.name }}
@@ -42,6 +42,30 @@ jobs:
             echo "dist_tag=latest" >> "$GITHUB_OUTPUT"
           fi
 
+      # The example is installed and built before either publish step, for two
+      # reasons:
+      #   1. Fail fast. Publishing is irreversible (npm refuses to reuse a
+      #      version), so a broken example should stop the release rather than
+      #      leaving a published package with no matching Pages deploy.
+      #   2. `setup-node` only writes an .npmrc, and exports
+      #      NPM_CONFIG_USERCONFIG pointing at it, when given `registry-url`,
+      #      and it never unsets that for subsequent steps. The .npmrc it writes
+      #      always contains a literal `_authToken=${NODE_AUTH_TOKEN}`, and as of
+      #      v7 the action no longer exports a dummy token when none is supplied
+      #      (actions/setup-node#1558). yarn v1 hard-errors on the unresolved
+      #      placeholder ("Failed to replace env in config"), so the example must
+      #      not run after a `registry-url` step. Ordering it first leaves it on
+      #      the default public registry with no .npmrc involved at all.
+      - name: install example dependencies
+        working-directory: ./example
+        run: yarn install --frozen-lockfile
+
+      - name: build example site
+        working-directory: ./example
+        run: yarn build
+        env:
+          PUBLIC_URL: '/monaco-sql-languages'
+
       - name: Publish to npm (trusted publishing)
         run: npm publish --tag ${{ steps.determine_dist_tag.outputs.dist_tag }}
 
@@ -55,26 +79,6 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
 
-      # Point the registry back at the public npm registry for the example install.
-      # `setup-node` exports NPM_CONFIG_USERCONFIG for the remainder of the job when
-      # `registry-url` is given, and it never unsets it, so a bare `setup-node` here
-      # would leave the private registry in effect. Passing an explicit `registry-url`
-      # rewrites that same .npmrc with the public registry instead.
-      - uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: install example dependencies
-        working-directory: ./example
-        run: yarn
-
-      - name: build example site
-        working-directory: ./example
-        run: yarn build
-        env:
-          PUBLIC_URL: '/monaco-sql-languages'
-
       - name: Deploy
         uses: peaceiris/actions-gh-pages@v4.1.0
         with: