From d55486977daf17a685647086e2bc5cd750a8094c Mon Sep 17 00:00:00 2001 From: funkpower Date: Mon, 21 Sep 2026 08:45:50 -0400 Subject: [PATCH] release: staging cannot create a package that has never existed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The registry answers POST /-/stage/package with a 404 for a name it has not seen, so the first release of a new name cannot be staged at all — no token scope changes that. The step now says so and lets the release stand rather than failing after PyPI has already published. The first version goes out by hand with 2FA; every one after it stages from here. --- .forgejo/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml index a96dcb6..be80c8f 100644 --- a/.forgejo/workflows/release.yml +++ b/.forgejo/workflows/release.yml @@ -147,5 +147,15 @@ jobs: echo "::notice::catena-corpus@$version is already published" exit 0 fi + # Staging offers a new version of a package that exists. It cannot + # bring one into being: the registry answers `POST /-/stage/package` + # with a 404 for a name it has never seen. So the first release of a + # new name is published by hand, with 2FA, and every release after + # it goes through here. Not a failure — PyPI is already out. + if ! npm view catena-corpus version >/dev/null 2>&1; then + echo "::warning::catena-corpus does not exist on npm yet, and staging cannot create it." + echo "::warning::Publish the first version by hand: npm publish crates/bindings/npm/dist --access public" + exit 0 + fi cd crates/bindings/npm/dist && npm stage publish --access public echo "::notice::staged catena-corpus@$version; approve it with 2FA to publish"