fix: don't fail the release on npm propagation timeout after our own publish by rabestro · Pull Request #276 · fortemate/dicechess-engine

rabestro · 2026-09-24T17:58:29Z

Summary

Supersedes #273. Ops: Release keeps failing after a successful npm publish because the npmjs.org read-after-write delay outlasts any fixed poll budget (#132, #266, #272). #273 (Jules) downgraded the unreadable-digest timeout in verify_integrity to a warning, but at every call site, and Hacktron flagged that as fail-open (finding). The finding holds for two of the three call sites.

This branch keeps the Jules commit (cherry-picked with -x) and adds one commit that limits the soft timeout to the call site #272 asks about:

`verify_integrity` call site	Who uploaded the package	Unreadable digest
Right after this run's own successful `npm publish`	this run	warning + `::warning::` annotation, the release continues
Package already present: the idempotent re-run, and the `--verify-only` mirror check before the canonical publication	an earlier run, or anyone with publish rights	fails closed
`npm publish` failed but the version appeared (concurrent run)	someone else	fails closed

A mismatched digest still fails at every call site.

Changes

npm-publish-if-missing.sh: verify_integrity after-publish on the two npm publish success branches; every other call keeps the fail-closed default.
test-npm-release-handoff.sh: new cases where an unreadable digest fails the --verify-only mirror check and the concurrent-publication path; the soft path now also asserts the ::warning:: annotation.

For the reviewer

If the GitHub Packages mirror still does not serve the digest when CD: Publish npmjs.org checks it, the canonical publication does not start and Ops: Release does not reach the GitHub Release. That is the gate doing its job, and the incidents behind Release: npm publish should not fail when registry propagation-check times out #272 were on npmjs.org, but the third item of the Release: npm publish should not fail when registry propagation-check times out #272 Definition of Done reads broader. Please confirm.
The warning annotation lands on the child CD: Publish npmjs.org run. Ops: Release only watches that run (gh run watch --exit-status), so the parent run shows nothing. After a soft timeout nothing re-checks the npmjs.org digest; a final fail-closed --verify-only against npmjs.org at the end of Ops: Release would restore that without blocking the bookkeeping steps. Not in this PR.

Test plan

mise run package:test-handoff passes
The extended test fails against the Release: npm publish should not fail when registry propagation-check times out #273 script: error: unreadable mirror digest passed verification
shellcheck 0.11.0 over .mise/lib and .mise/tasks (the CI command) is clean
mise run spdx:check passes
Fake-npm matrix over every call site: the existing-package (--verify-only and re-run) and concurrent paths fail on an unreadable or empty digest, the post-publish path passes with a warning, a mismatch fails
Not run locally: the sbt build and tests (no Scala or sbt changes; CI runs them)

Closes #272

🤖 Generated with Claude Code

Downgrade npm integrity verification timeouts in verify_integrity from hard failures (exit 1) to warnings (return 0). This prevents unbounded npmjs.org CDN propagation delays from aborting the release pipeline after a successful npm publish. Ref #132, #266 (cherry picked from commit 9492ce3)

The previous commit made verify_integrity treat an unreadable registry digest as success at every call site. #272 asks for that only right after this run's own successful npm publish, where the upload itself is the correctness signal and a propagation timeout must not abort the release. The other two call sites never uploaded anything: a package that already exists (the idempotent re-run, and the --verify-only mirror check before the canonical publication) and a version that a concurrent run published first. There the registry digest is the only proof that the package is ours, so an unreadable digest fails closed again. A digest mismatch still fails everywhere. The release handoff test now covers both fail-closed paths and asserts the ::warning:: annotation of the soft path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

hacktron-app · 2026-09-24T17:58:35Z

Hacktron Security Check - Skipped

Reason: OSS PR review limit reached for this approved repository and developer. New OSS PRs for this repository will resume at the start of the next cycle.

Wait for the next cycle. OSS quota is limited to the approved OSS repository and cannot be used on paid repositories.

coderabbitai · 2026-09-24T17:58:36Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: fortemate/dicechess-engine/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e2d73c8c-a121-40d5-a547-e1973f566018

📥 Commits

Reviewing files that changed from the base of the PR and between e99f433 and ddb3264.

📒 Files selected for processing (2)

.mise/lib/npm-publish-if-missing.sh
.mise/lib/test-npm-release-handoff.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

After this run successfully publishes a package, an integrity read timeout now produces a warning instead of failing. Other integrity checks, including mirror verification and concurrent publication checks, remain fail-closed.

Changes

Publish integrity verification

Layer / File(s)	Summary
Post-publish timeout policy `.mise/lib/npm-publish-if-missing.sh`	`verify_integrity` accepts a timeout policy. Calls after successful publishes use `after-publish`, which warns if the digest remains unavailable after the polling limit. The default policy still fails.
Timeout and fail-closed test coverage `.mise/lib/test-npm-release-handoff.sh`	The fixture checks warning output and successful tarball publication after a propagation timeout. It also checks that unreadable mirror and concurrent-publication digests still fail verification.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PublishScript
  participant NpmRegistry
  participant GitHubActions
  PublishScript->>NpmRegistry: Publish package
  PublishScript->>NpmRegistry: Poll published integrity
  NpmRegistry-->>PublishScript: Integrity remains unavailable
  PublishScript->>GitHubActions: Emit warning annotation when enabled

Merge Risk: ⚪ Minimal · up to ddb32

A successful publish can continue when npm’s digest is slow to appear, while the other integrity checks still fail. No merge-blocking issue was found.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing release failure after a successful npm publish when propagation times out.
Description check	✅ Passed	The description directly explains the propagation-timeout behavior, the fail-closed cases, the test coverage, and the scope of the changes.
Linked Issues check	✅ Passed	The changes satisfy the coding requirements in [`#272`]. `.mise/lib/npm-publish-if-missing.sh` applies the `after-publish` timeout policy only after this run's successful `npm publish`. A propagation ti…
Out of Scope Changes check	✅ Passed	The changed files are `.mise/lib/npm-publish-if-missing.sh` and `.mise/lib/test-npm-release-handoff.sh`. The implementation and fixture changes directly support [`#272`] by limiting soft timeouts to pos…
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-24T18:10:07Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

rabestro · 2026-09-24T18:31:42Z

@CodeRabbit review

coderabbitai · 2026-09-24T18:31:49Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

google-labs-jules Bot and others added 2 commits September 24, 2026 20:55

github-actions Bot added the bug Something is not working label Sep 24, 2026

rabestro self-assigned this Sep 24, 2026

rabestro merged commit 1141826 into main Sep 24, 2026
13 checks passed

rabestro deleted the bug/272-npm-soft-timeout-after-publish branch September 24, 2026 18:45

Navigation Menu

fix: don't fail the release on npm propagation timeout after our own publish - #276

fix: don't fail the release on npm propagation timeout after our own publish#276
rabestro merged 2 commits into
mainfrom
bug/272-npm-soft-timeout-after-publish

rabestro commented Sep 24, 2026

Uh oh!

hacktron-app Bot commented Sep 24, 2026

Uh oh!

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

sonarqubecloud Bot commented Sep 24, 2026

Uh oh!

rabestro commented Sep 24, 2026

Uh oh!

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

rabestro commented Sep 24, 2026

Summary

Changes

For the reviewer

Test plan

Uh oh!

hacktron-app Bot commented Sep 24, 2026

Hacktron Security Check - Skipped

Uh oh!

coderabbitai Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

sonarqubecloud Bot commented Sep 24, 2026

Quality Gate passed

Uh oh!

rabestro commented Sep 24, 2026

Uh oh!

coderabbitai Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading