From 2583f68bf9731deaf9a1a5f5e4a442d2a8057d07 Mon Sep 17 00:00:00 2001 From: Robert Hebel Date: Wed, 21 Oct 2026 14:11:53 +0200 Subject: [PATCH] fix(release): retry failed package publishing Sigstore transparency log intermittently answers TLOG_CREATE_ENTRY_ERROR (409) during provenance publishing, which fails the release. Retry lerna publish from-package up to 5 times; versions already on npm are skipped. If every attempt fails, publish the remaining packages without provenance. Drop --concurrency 1, which did not address the cause. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release.yml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e8916ec7d..321248366 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -46,7 +46,17 @@ jobs: GH_TOKEN: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }} NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - name: Publish monorepo npm packages - run: npx lerna publish from-package --no-private --yes --concurrency 1 + run: | + # `from-package` skips versions already on npm, so retrying only republishes failed packages + for attempt in 1 2 3 4 5; do + npx lerna publish from-package --no-private --yes && exit 0 + echo "Publish attempt $attempt failed" + sleep 30 + done + # Last resort: Sigstore keeps rejecting the attestation, publish remaining packages without provenance + echo "::warning::Publishing remaining packages without provenance" + sed -i 's/"provenance": true/"provenance": false/' packages/*/package.json + npx lerna publish from-package --no-private --yes env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}