[sunib]

A later push retried npm publication of 0.6.0 after the release run had already succeeded. The metadata guard missed the existing version, and npm rejected the duplicate upload. Recover that explicit rejection only when fresh registry metadata confirms the validated tarball’s SHA-512 integrity.

The publish step now runs through the release script. Duplicate confirmation makes at most five registry reads, with two seconds between reads and the existing 30-second request timeout. Registry reads request cache revalidation. Authentication errors, other publish errors, metadata failures, unavailable versions and integrity mismatches remain failures; the recovery path never republishes.

The external adopter report correctly identified the first release attempt’s Go checksum-database 404 for gateway/v0.6.0. Its conclusion that npm was unpublished became outdated: attempt 2 subsequently passed and published 0.6.0. The release guide records both that incident and the later duplicate-upload failure, with links to the runs. This change does not bypass checksum verification or publish a new release.

Validation:

• node --test .github/scripts/release.test.mjs — 13 passing tests, including delayed visibility, matching/mismatched integrity, non-duplicate errors, bounded confirmation and registry failure.
• actionlint .github/workflows/release.yml — passed.
• git diff --check — passed.

Summary by CodeRabbit

• Bug Fixes
  • Release publishing now confirms that an already-published version matches the validated release package before treating the upload as successful. Other publishing errors, unavailable registry information, or mismatched packages still fail the release.
• Documentation
  • Updated release guidance with the publishing checks and steps for verifying release status after an upload issue. Added details about the 0.6.0 release incident and recovery guidance.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40f17c87-2623-409d-a6ed-7e5f1c733a7f

📥 Commits

Reviewing files that changed from the base of the PR and between 12bb2b1 and 869ea81.

📒 Files selected for processing (4)

• .github/scripts/release.mjs
• .github/scripts/release.test.mjs
• .github/workflows/release.yml
• docs/releasing.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release script now publishes validated tarballs and handles duplicate-version rejections by checking registry metadata. The release workflow invokes this command, and tests and release guidance describe the confirmation behavior and its failure cases.

Changes

npm release publication

Layer / File(s)	Summary
Publish and confirm release .github/scripts/release.mjs, .github/scripts/release.test.mjs, docs/releasing.md	The script validates the tarball and publishes it with provenance and public access. After a matching duplicate-version rejection, it checks registry metadata up to five times and accepts an existing release only when its SHA-512 integrity matches. Tests and release guidance cover confirmation and failure cases.
Workflow publication wiring .github/workflows/release.yml	The workflow passes the prepared version to the release script instead of running npm publish directly.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant ReleaseScript
  participant NpmRegistry
  ReleaseWorkflow->>ReleaseScript: Invoke publish with prepared version
  ReleaseScript->>NpmRegistry: Publish validated tarball
  NpmRegistry-->>ReleaseScript: Publish result
  ReleaseScript->>NpmRegistry: Read version metadata after matching duplicate rejection
  NpmRegistry-->>ReleaseScript: Version and SHA-512 integrity

Loading

Merge Risk: ⚪ Minimal · up to 869ea

The release job now recovers from a duplicate npm upload only when the registry confirms the same tarball integrity. All other failures still fail the job. No merge-blocking risk was identified.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 869ea

The new recovery path preserves publishing permissions and provenance, requires matching artifact integrity, and never republishes during confirmation. Already-visible versions still use the older version-only skip check, so integrity confirmation is not universal across reruns.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The direct sensitive outcome is publication or acceptance of a release for @configbutler/krm-stream, potentially affecting its downstream consumers. The changed path does not introduce a public request handler: it remains behind the main-branch release workflow and its publication job.

Trust Boundaries and Controls

• observed — The npm job retains its OIDC permission, public-registry configuration and non-persisted checkout credentials. Moving publication into the script retains the previous --provenance and --access public flags; no additional publishing permission is introduced by the inspected workflow change.

Resilience and Maintainability Implications

• observed — The pre-existing needsPublish gate accepts version presence without comparing tarball integrity. Resolve or verify can therefore skip publication on a rerun before the new recovery function executes. This limits the scope of the new integrity guarantee but is unchanged behavior, not an introduced PR concern.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (2 skipped: 2…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: verifying artifact integrity after npm rejects a duplicate publication.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}