Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| - name: Publish to npm | ||
| run: npm publish --provenance --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
There was a problem hiding this comment.
Bug: The release workflow may publish a different version to npm than what is specified in the git tag, causing a version mismatch between npm and the GitHub release.
Severity: MEDIUM
Suggested Fix
Add a validation step to the workflow before the npm publish command. This step should extract the version from package.json and compare it with the version from the git tag ($GITHUB_REF_NAME). If the versions do not match, the workflow should fail to prevent the inconsistent release.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/release.yml#L32-L35
Potential issue: The release workflow uses two different sources for the version number,
creating a potential mismatch. The `npm publish` step uses the version from
`package.json`, while the GitHub Release creation step uses the version from the git tag
(`GITHUB_REF_NAME`). If a developer pushes a tag that doesn't match the version in
`package.json`, the version published to the npm registry will be different from the one
documented in the GitHub release, causing versioning confusion for consumers of the
package.
Did we get this right? 👍 / 👎 to inform future reviews.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| - name: Publish to npm | ||
| run: npm publish --provenance --access public | ||
| env: | ||
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} |
There was a problem hiding this comment.
Published npm package will exclude dist/ build output
High Severity
The npm publish step will produce a broken package. The dist/ directory is listed in .gitignore, and since there's no .npmignore file or files field in package.json, npm uses .gitignore rules and will exclude dist/ from the published package. The package.json declares main, types, and bin entries pointing to files in dist/, so the published package would be missing all compiled code.
1 participant
No description provided.