[ignaciocapodanno]

Description

The mirror to GitHub Packages has never published. It failed on the 0.23.1 release with No token found and can't prompt for login when running with --non-interactive, and before that it was always skipped, because it runs after the npm publish in the same job and that step had been failing.

The npm publish ends with [4/4] Revoking token, and yarn looks the credential up by the default registry rather than by --registry. The step appended its token to the npmrc and passed --registry, so yarn never used it. It now writes the npmrc instead of appending to it, with GitHub Packages as the default registry, and drops the flag.

This matters because frontapp/front installs @frontapp/ui-kit from npm.pkg.github.com, so a version that only reaches npm never reaches the app.

Links

Jira
Failed run

Risks and recovery

CI only, nothing in the published package changes. The worst case is the same failure as today, with npm already published and the mirror still missing. Reverting the commit is enough.

Checklist:

• I have performed a self-review of my own code.
• I have added or updated tests to cover my changes, or explained why not.
• I have manually tested my change on staging / canaried my change, or explained why not.

Testing

A workflow step cannot be tested outside Actions, so what was checked locally is the part that is not the credential:

• The npmrc the step writes, run with a fake token: it ends up with registry=https://npm.pkg.github.com and the matching _authToken line, and npm config get registry resolves to GitHub Packages.
• The workflow still parses, and the step's run and env are intact.

What is not proven until this merges: that yarn publish authenticates against GitHub Packages with GITHUB_TOKEN. Since 0.23.1 is already on npm, the npm step will fail on a re-run of that release, so the real proof is the next release publishing to both registries.

[kyle-pierce]

Looking at the code history, this is the first time we ran this step, right? It's not that it was working and stopped?

[ignaciocapodanno]

Looking at the code history, this is the first time we ran this step, right? It's not that it was working and stopped?

Yes, first run. The job only runs on a release, and there was none between #326 and today, so it was always skipped.