Repository navigation
docs(release): document the wrapper install-verification steps - #139
Merged
Merged
Conversation
The npm publish job going green does not mean the version is visible on npmjs.com yet — the registry takes a few minutes to propagate. Add that warning, plus the full verification procedure for the wrapper's postinstall path (publish metadata, npm audit, the npm 12 allowScripts gate, and the quarantine check on the downloaded binary). The quarantine check is the part that matters most: the wrapper strips the attribute itself, so a binary that still carries it would be killed by macOS before main() ever runs.
|
✔️ db2b714 - Conventional commits check succeeded. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the missing verification procedure to
docs/release-checklist.mdfor the npm wrapper's install path.
The
publish-npmjob going green does not mean the version is visibleon npmjs.com yet — the registry takes a few minutes to propagate, and
verifying before that looks like a phantom failure.
The new section covers:
npm view nodeupx version dependencies engines)npm install+npm auditagainst the published package ratherthan the local checkout
allowScriptsgate and itsapprove+ re-installremedy
xattr -p com.apple.quarantinecheck on the downloaded binaryThat last one is the point of the exercise: the wrapper strips the
attribute itself, so a binary that still carries it would be killed by
macOS before
main()ever runs — exactly the failure mode v1.2.2fixed.
Test plan
make cigreen (docs-only change)published
nodeupx@1.2.3— including the quarantine check andthe
nodeup versionrun