fix(ci): repair the scheduled observation and package publish workflows - #9
Merged
Conversation
The daily run has failed every day since at least 2026-07-25, all at the
same line: `observations/Bitcoin.json: No such file or directory`. The
directory is not in the repo and nothing created it, so the redirect
failed under `bash -e` before the CLI ever ran.
Four fixes, three of which would have surfaced only after the first:
- `mkdir -p observations` before the loop.
- The commit step ran `git diff --quiet` after `git add`, which compares
the worktree to the index and is therefore always quiet. It would have
reported "No changes" and committed nothing, forever. Use
`git diff --cached --quiet`.
- Analysis wrote with `2>&1`, folding progress messages ("Analyzing…",
"Fetched 20 revisions.") into the JSON file. Every committed
observation would have been unparseable. Write to `$RUNNER_TEMP` and
move only on success, so a failed analysis leaves no artifact.
- The `pages` input was interpolated into the shell via `${{ }}`. Pass it
through `env:` instead.
Also declares `permissions: contents: write`, which the push step needs
and never reached.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
npm's latest `@refract-org/cli` is 0.5.7, published 2026-05-18. The repo
is at 0.5.13. Nothing has landed on npm in 71 days, and the reason is
entirely in this workflow.
`npm publish` resolved to the bun-backed shim that setup-bun puts ahead
of Node's npm in PATH. Bun's implementation has no OIDC token exchange,
so v0.5.8 through v0.5.11 all died with:
error: missing authentication (run `bunx npm login`)
v0.5.12 then reported **success** while every package failed:
npm error 404 Not Found - PUT https://registry.npmjs.org/@refract-org%2fcli
`|| true` swallowed it. The tag looked released and was not.
Three changes:
- Resolve npm from the Node toolchain by path, bypassing the shim.
- Drop `|| true`, so a 404 fails the run instead of being reported green.
- Drop `bun test || echo "publishing anyway"`. A publish that ignores its
own test results is how a broken tarball reaches users.
Also threads `NODE_AUTH_TOKEN` through, so a repo secret works as a
fallback where OIDC trusted publishing is not configured.
Note: this does not by itself fix authentication. The 404-on-PUT means
npm is rejecting the write, so trusted publishing still has to be
configured on npmjs.com for each package, or an NPM_TOKEN secret added —
the repo currently has no secrets set. What this change guarantees is
that the next failure is visible.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
zz-plant
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two scheduled/tagged workflows have been failing silently. Neither is a code problem.
1.
publish.yml— npm has been stale for 71 daysnpm's latest
@refract-org/cliis 0.5.7 (2026-05-18). The repo is at 0.5.13.This matters more than the version gap suggests. cli 0.5.7 declares
"@refract-org/analyzers": "^0.3.0", which resolves to 0.3.x — before semantic enrichment existed. So the first command in the README:fails on a clean machine with:
Verified just now against the live registry. The fix already exists in-repo —
45d4446 chore: bump CLI to v0.5.8 (fix analyzers dep resolution), 2026-05-23 — it simply never reached npm.Why it never reached npm:
npm publishresolved to the bun-backed shim thatsetup-bunputs ahead of Node's npm in PATH. Bun's implementation has no OIDC token exchange, so every run died witherror: missing authentication (run bunx npm login).npm error 404 Not Found - PUT https://registry.npmjs.org/@refract-org%2fcli.|| trueswallowed it.Changes: resolve npm from the Node toolchain by path; drop
|| trueso a 404 fails the run; dropbun test || echo "publishing anyway"; threadNODE_AUTH_TOKENthrough as a fallback.This does not fix authentication. A 404-on-PUT is npm rejecting the write. Trusted publishing still has to be configured on npmjs.com per package, or an
NPM_TOKENsecret added — the repo currently has no secrets set. What this change guarantees is that the next failure is visible instead of green.2.
observe.yml— failing daily since at least 2026-07-21Every run dies at
observations/Bitcoin.json: No such file or directory. The directory is not in the repo, so the redirect failed underbash -ebefore the CLI ran.Three further faults sat behind it:
git diff --quietran aftergit add, comparing worktree to index — always quiet. It would have printed "No changes" indefinitely. Nowgit diff --cached --quiet.2>&1folded progress output into the JSON. Verified locally: the CLI writesAnalyzing "Bitcoin" at depth: detailed...to stderr, which would have landed at the top of the file. Output now goes to$RUNNER_TEMPand moves only on success.permissions: contents: writewas never declared, and the push step needs it.Also passes the
pagesinput throughenv:rather than interpolating it into the shell with${{ }}.🤖 Generated with Claude Code