Github actions tests always fail

[TheMcMurder]

[X] new bot user
[X] Work around npm/cli#2834
[X] Working publish

npm/cli#2834

TL;DR A bug in NPM and a lack of support for an alternative approach in release-it left me to use it weirdly to work around the bug.

This one is nasty. Turns out that a bug in npm causes publish to fail if publishConfig is in package.json. That configuration cannot go in .npmrc. release-it doesn't support sending in arbitrary command line arguments to the npm publish command and doesn't support the setting access via the configuration. So I looked through the source and found that here: https://github.com/release-it/release-it/blob/2ccf01fd242309840020cfa82034ade4851c6cf7/lib/plugin/npm/npm.js#L232 it runs npm publish ${publishPath} using the publishPath option from release-it.json's npm config block.

So I set it up to pass in . --access=public instead of null which defaults to . turning the command to: npm publish . --access=public

[TheMcMurder]

I also "suspended" renovate

[TheMcMurder]

I believe I've resolved the issue. It took me an embarrassingly long amount of time to realize the ultimate problem wasn't with release-it but it was with actions/checkout@v2

checkout@v2 was saving credentials. It made it practically impossible to set the user to anything else. The key change was here

Summary on how we need to fix this issue in the other repos

release-it.json

needs to configure npm. I may create an issue/mr in the project to add this functionality without this weird hack/workaround.

{
  "github": {
    "release": true
  },
  "plugins": {
    "release-it-plugin-esm-bundle": {}
  },
  "npm": {
    "publishPath": ". --access=public"
  }
}

build-and-test.yml github action

We need to change the publish step to look roughly like this

publish:
    runs-on: ubuntu-latest
    env:
      # used by 'release-it'
      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
      GITHUB_TOKEN: ${{ secrets.PUBLISH_BOT }}
      # used manually in setting git config
      BOT_EMAIL: ${{ secrets.PUBLISH_BOT_EMAIL }}
      # used by unit tests
      MOZ_HEADLESS: 1
    needs: build
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v2
        with:
          # Use our own token instead of the default token
          # this step persists login credentials so strongly that we couldn't get them to override
          token: ${{ secrets.PUBLISH_BOT }}
      - uses: actions/setup-node@v2
        with:
          node-version: "15"
      - uses: pnpm/action-setup@v1.2.1
        with:
          version: 5.17.3
      - run: pnpm install --frozen-lockfile
      - name: Setup auth
        run: |
          git config --global user.email "$BOT_EMAIL"
          git config --global user.name "esm-bundle-org-bot"
          echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > .npmrc
      - name: "Publish to npm"
        run: pnpm run release

package.json

See discussion on race condition below. Because of the weird behavior we've been in each package.json may need to be manually updated to match what is in npm to get things back in a 100% working order.

[TheMcMurder]

My testing exposed a race condition.

• in progress build/deploy
• a new commit goes to master

Guaranteed to fail. Release-it will try to push and it'll be rejected because of upstream changes.

This is problematic for multiple reasons.

1. The release tags are never sent upstream
2. The package.json is never updated so future builds immediately fail as release-it tries to release over an already released version.

This happened a few times to me during testing. Ultimately it was often caused by renovate's auto-merge.

Build failed -> I fixed it -> pushed fix -> while build was in process renovate auto-reverted to an older version -> build failed and all future builds fail until the package.json has the same version as latest on NPM.

My choices to fix it were: wait for a new version of the npm package (or force one) or manually update the version in package.json