From 5967c3f2e8d445a3c0a6c7394e37f6ae8c5f70f3 Mon Sep 17 00:00:00 2001 From: "Lorenzo S." Date: Fri, 11 Sep 2026 14:20:51 +0200 Subject: [PATCH] Publish the tarball npm packed, not a git URL npm reads an argument that contains a slash but does not start with ./, / or ../ as a hosted git shorthand, so `npm publish dist/scrollcase-1.1.1.tgz` became a request to clone ssh://git@github.com/dist/scrollcase-1.1.1.tgz.git and failed on a missing public key. Both releases this workflow has seen - 1.1.0 and 1.1.1 - failed that way and went out by hand, which is exactly the laptop publish the workflow was written to replace. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish-npm.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index db4d573..f7b9d75 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -85,6 +85,11 @@ jobs: # The glob is resolved and counted rather than passed straight to npm: `npm publish` given two # paths would publish the first and say nothing about the second, and given none would fall # back to publishing the current directory — which here is an empty runner, not the package. + # + # The `./` below is load-bearing. npm reads an argument that contains a slash but does not + # start with `./`, `/` or `../` as a hosted git shorthand, so `dist/scrollcase-1.1.1.tgz` + # became a request to clone `ssh://git@github.com/dist/scrollcase-1.1.1.tgz.git`. That is how + # both releases this workflow has seen failed, and went out by hand instead. - name: Publish shell: bash run: | @@ -96,4 +101,4 @@ jobs: printf ' %s\n' "${tarballs[@]}" >&2 exit 1 fi - npm publish "${tarballs[0]}" + npm publish "./${tarballs[0]}"