From d0bf37cd262eac65de300dcfa9f75556e7d8294f Mon Sep 17 00:00:00 2001 From: Theo Ephraim Date: Fri, 13 Nov 2026 02:15:15 +0000 Subject: [PATCH] Fix release: stop parsing npm pack --json, pin npm 11 npm@latest is now npm 12, which changed npm pack --json from an array to an object keyed by package name, so fetch-native-helpers failed before publish. --- .github/workflows/release.yaml | 5 +++-- scripts/fetch-native-helpers.ts | 7 +++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index f4e1e2df7..092393d01 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -194,9 +194,10 @@ jobs: - name: Install node deps run: bun install # No turbo cache: published artifacts are always built from source. - # Ensure npm >= 11.15.0 for OIDC/provenance + # npm >= 11.15.0 for OIDC/provenance. Pinned to 11: npm 12 changed CLI output + # (e.g. `npm pack --json`) that release tooling reads. - name: Update npm - run: npm install -g npm@latest + run: npm install -g npm@^11.15.0 # Native helpers: binaries built, signed, and notarized earlier in this run # for helpers this publish releases; the published version pinned by varlock diff --git a/scripts/fetch-native-helpers.ts b/scripts/fetch-native-helpers.ts index 28cfa9d30..fedf0a308 100644 --- a/scripts/fetch-native-helpers.ts +++ b/scripts/fetch-native-helpers.ts @@ -70,8 +70,11 @@ for (const suffix of platforms) { const workDir = path.join(tmp, suffix); fs.mkdirSync(workDir); - const [packed] = JSON.parse(npm(['pack', spec, '--json'], workDir)); - execFileSync('tar', ['-xzf', packed.filename], { cwd: workDir }); + // don't parse `npm pack --json`: npm 12 changed it from an array to an object keyed by name + npm(['pack', spec], workDir); + const tarballs = fs.readdirSync(workDir).filter((f) => f.endsWith('.tgz')); + if (tarballs.length !== 1) throw new Error(`expected one tarball from npm pack ${spec}, found: ${tarballs.join(', ') || 'none'}`); + execFileSync('tar', ['-xzf', tarballs[0]!], { cwd: workDir }); const entry = SUBDIR_CONTENTS[suffix]; const destDir = path.join(DEST, suffix);