fix: npm publish workflow - #113
Merged
Merged
Conversation
Stop ignoring package-lock.json and commit it so `npm ci` (used in the new GitHub Actions workflows) has a lockfile to install from. It was previously untracked/ignored (since #86), which made sense before npm ci existed, but now blocks reproducible CI installs. This has no effect on the published package, since "files": ["lib"] already excludes the lockfile from the npm tarball. Co-authored-by: Cursor <cursoragent@cursor.com>
The lockfile committed in adfee80 was generated inside a sandbox whose npm config defaults to an internal Netflix Artifactory registry mirror, so every "resolved" tarball URL pointed at artifacts.netflix.net instead of registry.npmjs.org. That's unreachable from GitHub-hosted runners and external contributors, which would break `npm ci` for anyone outside Netflix's network. Versions and integrity hashes are unchanged; only the resolved host differs. Co-authored-by: Cursor <cursoragent@cursor.com>
Node 24 fails due to a known restify/spdy incompatibility (removed
process.binding('http_parser') internal API) unrelated to this
package; the job's name implies its failures shouldn't block merges,
so make that actually true.
Co-authored-by: Cursor <cursoragent@cursor.com>
Senseye
force-pushed
the
fix/npm-publish
branch
from
August 10, 2026 15:39
0777131 to
04b0cb6
Compare
Job-level continue-on-error only stops the failure from cascading to the overall workflow run/needs-dependent jobs; it doesn't change the job's own reported check conclusion, so test-optional still showed as a failing check on PRs. Moving it to the individual steps makes the job itself report success while still surfacing Node 24 failures in the logs. Co-authored-by: Cursor <cursoragent@cursor.com>
wesleytodd
requested changes
Aug 17, 2026
wesleytodd
left a comment
wesleytodd
left a comment
Member
There was a problem hiding this comment.
A few changes that I think might be necessary, but mostly questions. I will leave this as request changes, but since I already was behind on reviewing it if you are confident in the answers to my questions don't let that block merging. This is low risk and we can change anything forward as necessary.
Co-authored-by: Cursor <cursoragent@cursor.com>
Senseye
force-pushed
the
fix/npm-publish
branch
from
August 17, 2026 18:41
79077e5 to
31122dd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm-publish.yml workflow for enabling npm trusted publishing.
Notes: