From 53cab8a66c026e7f7cbdbac5ea2f66eb7dd8a4d5 Mon Sep 17 00:00:00 2001 From: Howard Askew <19271569+howaskew@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:15:37 +0100 Subject: [PATCH 1/2] ci: Fix the publish loop guard and push before publishing - Loop guard: skip runs started by openactive[bot] and add a skip-CI marker to the version bump commit. The previous guard checked for hello@openactive.io, but the bot has committed as 207210293+openactive[bot] since May 2025, so every bump commit would start another publish. - Push the version bump before publishing, so a rejected push stops the run before anything reaches npm. - Publish on Node 18.17.1 instead of Node 14 (tests pass locally on 18). - Publish with NPM_TOKEN2, a repo-level token to be added (the org NPM_TOKEN is rejected by npm). - Run one publish at a time, and update actions to current versions. Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/publish-to-npm.yaml | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/workflows/publish-to-npm.yaml b/.github/workflows/publish-to-npm.yaml index f7f0373e..4e1278bf 100644 --- a/.github/workflows/publish-to-npm.yaml +++ b/.github/workflows/publish-to-npm.yaml @@ -4,10 +4,19 @@ on: push: branches: [ main ] +# Never run two publishes at once; a second merge waits for the first to finish +concurrency: + group: publish-to-npm + cancel-in-progress: false + +permissions: + contents: read + jobs: publish: runs-on: ubuntu-latest - if: "!contains(github.event.head_commit.author.email, 'hello@openactive.io')" + # Loop guard: the version bump commit below is pushed by the OpenActive GitHub App, and also carries [skip ci] + if: ${{ github.actor != 'openactive[bot]' }} steps: - name: Generate GitHub App Token @@ -24,20 +33,21 @@ jobs: run: | git config --global user.name "openactive[bot]" git config --global user.email 207210293+openactive[bot]@users.noreply.github.com - - name: Use Node.js 14.x - uses: actions/setup-node@v1 + - name: Use Node.js 18.17.1 + uses: actions/setup-node@v4 with: - node-version: 14 + node-version: 18.17.1 registry-url: https://registry.npmjs.org/ - name: Install run: npm ci - name: Test run: npm test - name: Increment Version - run: npm version patch + run: npm version patch -m "%s [skip ci]" + # Push before publishing: if the push is rejected, nothing is published, so npm can never get ahead of GitHub + - name: Push version update + run: git push origin HEAD:main - name: Publish to npm run: npm publish env: - NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}} - - name: Push version update - run: git push + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN2 }} From 772e0fb5797786b0cd31b0076229c74f974b9d5a Mon Sep 17 00:00:00 2001 From: Howard Askew <19271569+howaskew@users.noreply.github.com> Date: Mon, 19 Oct 2026 15:16:03 +0100 Subject: [PATCH 2/2] Set package version to 1.0.4 to match npm 1.0.4 is already published on npm, but the version bump commit never reached GitHub because the push after publishing failed. Without this, the next release would try to publish 1.0.4 again and npm would reject it. Co-Authored-By: Claude Opus 5.5 (1M context) --- package-lock.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2fb97eac..0e000ab5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "@openactive/models-ts", - "version": "1.0.3", + "version": "1.0.4", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index a17b5ff9..f18fc575 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@openactive/models-ts", - "version": "1.0.3", + "version": "1.0.4", "description": "JavaScript/TypeScript implementation of OpenActive's data model", "main": "lib/index.js", "typings": "lib/index.d.ts",