ci: retire a version the way npm actually allows — deprecate, from CI - #47
Merged
Conversation
The 1.x line has to stop being installed, and unpublishing it from CI turned out to be impossible: npm refuses a granular token that bypasses 2FA (#46). This is the half of that job the registry does allow. `npm deprecate` is also the better instrument for the goal. It leaves the tarball in place, so anyone pinned keeps working, and prints a warning on every install — which is the outcome an unpublish only approximates, by breaking them instead. RELEASE.md already named it the default; there was just no way to run it, because the only credential this project has is a repository secret. Reversible, which is why this one is safe to keep where the unpublish workflow was not: dispatching with an empty `message` clears the flag, per npm's own convention. A mistake here is one more dispatch, not a burned version number. One guard, for the one-click mistake that matters: the version in package.json is refused. Deprecating whatever dist-tags.latest points at puts a warning on every install of the package and reads as an outage. Verification reads the ANONYMOUS packument and asserts each version landed in the requested state, plus that the live release is not flagged. `npm deprecate` exiting 0 is not evidence, for the same reason publish.yml has a gate 6. A version that refuses warns and the loop continues, then the job fails at the end — one refusal must not leave the rest of the line unmarked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.x line has to stop being installed, and unpublishing it from CI turned out to be impossible — npm refuses a granular token that bypasses 2FA (#46). This is the half of that job the registry does allow.
npm deprecateis also the better instrument for the goal: it leaves the tarball in place, so anyone pinned keeps working, and prints a warning on every install — the outcome an unpublish only approximates, by breaking them instead.RELEASE.mdalready named it the default; there was simply no way to run it, since the only credential this project has is a repository secret.Reversible, which is why this one is safe to keep where the unpublish workflow was not: dispatching with an empty
messageclears the flag, per npm's own convention. A mistake is one more dispatch, not a burned version number.package.jsonis refused. Deprecating whateverdist-tags.latestpoints at warns on every install of the package and reads as an outage.npm deprecateexiting 0 is not evidence — same reasonpublish.ymlhas a gate 6.Dispatched after merge against
1.0.2 1.1.0 1.2.0 1.2.1 1.3.0 1.3.1 1.3.2 1.4.0 1.5.0. The hard withdrawal of those versions still needs an interactivenpm loginfrom a maintainer's machine before the 72-hour window closes at 2026-08-28T09:23Z.