ci: wait for the registry, and keep the record when a later check fails

[jiashuoz]

v0.0.11 published onto latest correctly and the run still reported failure.

1. The registry lags its own writes

npm notice Publishing to https://registry.npmjs.org/ with tag latest
✓ Publish to npm
X Verify the published package end to end
  npm error code ETARGET
  npm error notarget No matching version found for @tokencanopy/rainier@0.0.11

The publish succeeded; the very next line asked for the version it had just written and npm's read cache hadn't caught up. Verification now polls for resolvability (10s × 30, five minutes) before drawing any conclusion. A published release is not broken merely because it is not readable yet.

Confirmed by hand minutes later: npm view @tokencanopy/rainier@0.0.11 version → 0.0.11.

2. That failure threw away the record — again

Second release running where a post-publish failure discarded the pins PR, leaving the package public and main describing the previous release.

Recording is now keyed to steps.publish.outcome, not the job's status: once the package is public the record gets written even if a later check fails, and it is not written if the publish never happened. !cancelled() alone would have recorded pins for a release that failed to publish.

3. v0.0.11's pins

Included here because the aborted step would have written them. Taken from the release.js inside the published tarball, so main describes exactly what the registry serves.

The point of all this

before:  latest -> 0.0.3   (six releases, four days behind)
now:     latest -> 0.0.11

A bare npm install -g @tokencanopy/rainier reports rainier v0.0.11 and refuses diff. Previously it installed 0.0.3 — a downgrade for anyone already on 0.0.9.

The compact package.json formatting also survived the publish, confirming the in-place rewrite from #78.

Verification

• YAML parses; Record the pins on main carries the publish-scoped condition.
• 11/11 npm tests; no stale 0.0.10 reference in npm/.
• Committed release.js is byte-identical to the published one.
• Real bare install from the registry into a clean HOME.

The retry path itself is not exercised until the next release — the lag it handles is observed in the run log above, not reproduced.

🤖 Generated with Claude Code

https://claude.ai/code/session_019SDSieWT6mnHB1EYXUyz7H