From 6bca05f84211f12d8b1edb9cd3e849441db40e0b Mon Sep 17 00:00:00 2001 From: avallete Date: Tue, 12 May 2026 10:36:52 +0200 Subject: [PATCH] fix(ci): make deploy workflows self-bootstrapping MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both deploy workflows ran `yarn install --frozen-lockfile` from the workspace root, which tries to resolve every workspace package's dependencies — including the `pg-protocol: npm:@supabase/pg-protocol@ ^X.Y.Z` alias declared in packages/pg/package.json. Any time we bump pg-protocol to a new version, install fails because the new version isn't on npm yet (deploy-pg-protocol.yml is the workflow that's *about to* publish it). The same workflow on the same merge commit fired in parallel for pg and both jobs died at install before they could publish anything. Fix: run install/build/publish strictly inside each package directory. - deploy-pg-protocol.yml: pg-protocol is a leaf TypeScript package with no runtime deps and only TS toolchain devDeps. We can install + build + publish inside packages/pg-protocol/ in full isolation. Use `npm install --workspaces=false --prefix .` so npm doesn't walk up to the workspace root package.json (verified locally — without these flags npm still pulls in the root deps and hits an ESLint peer-dep conflict). - deploy-pg.yml: pg is plain JavaScript — there is no build step (esm/index.mjs is hand-written) and `npm publish` packs straight from the `files` field without resolving any dependencies. So we drop the install step entirely and just `cd packages/pg && npm publish`. Both workflows still trigger on push to master with their existing paths filter; we additionally trigger on changes to the workflow file itself so future workflow tweaks are testable end-to-end without an unrelated source-file change. --- .github/workflows/deploy-pg-protocol.yml | 23 +++++++++++++++++++---- .github/workflows/deploy-pg.yml | 17 +++++++++++++---- 2 files changed, 32 insertions(+), 8 deletions(-) diff --git a/.github/workflows/deploy-pg-protocol.yml b/.github/workflows/deploy-pg-protocol.yml index 12d22333c..d85a6b230 100644 --- a/.github/workflows/deploy-pg-protocol.yml +++ b/.github/workflows/deploy-pg-protocol.yml @@ -6,6 +6,7 @@ on: - master paths: - 'packages/pg-protocol/**' + - '.github/workflows/deploy-pg-protocol.yml' workflow_dispatch: inputs: version: @@ -20,6 +21,16 @@ permissions: jobs: deploy: runs-on: ubuntu-latest + # IMPORTANT: install/build/publish strictly inside packages/pg-protocol/ + # to avoid touching the workspace root. The root yarn.lock contains the + # `pg-protocol: npm:@supabase/pg-protocol@^X.Y.Z` alias, which would fail + # resolution any time we bump pg-protocol's version (the new version is + # not on npm yet — that's exactly what this workflow is publishing). + # pg-protocol has no runtime deps and only TS toolchain devDeps, so + # `npm install` inside the package directory is fully self-contained. + defaults: + run: + working-directory: packages/pg-protocol steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -29,15 +40,19 @@ jobs: node-version: '20' registry-url: 'https://registry.npmjs.org' - - name: Install dependencies - run: yarn install --frozen-lockfile + - name: Install pg-protocol devDependencies (isolated, no workspace root) + # --workspaces=false + --prefix . is required to stop npm from + # walking up to the workspace root package.json. Without it, npm + # tries to resolve every workspace package's deps and trips on + # the unpublished `@supabase/pg-protocol@^X.Y.Z` alias in pg. + run: npm install --no-package-lock --no-audit --no-fund --workspaces=false --prefix . - name: Build package - run: cd packages/pg-protocol && yarn build + run: npm run build # Ensure npm 11.5.1 or later is installed for trusted publishing support - name: Update npm run: npm install -g npm@latest - name: Publish to npm - run: cd packages/pg-protocol && npm publish + run: npm publish diff --git a/.github/workflows/deploy-pg.yml b/.github/workflows/deploy-pg.yml index 1621ddf91..29af67afe 100644 --- a/.github/workflows/deploy-pg.yml +++ b/.github/workflows/deploy-pg.yml @@ -6,6 +6,7 @@ on: - master paths: - 'packages/pg/**' + - '.github/workflows/deploy-pg.yml' workflow_dispatch: inputs: version: @@ -20,6 +21,17 @@ permissions: jobs: deploy: runs-on: ubuntu-latest + # IMPORTANT: do NOT run a workspace-root install here. pg's + # package.json declares `pg-protocol: npm:@supabase/pg-protocol@^X.Y.Z`, + # and any time we bump pg-protocol's version this workflow would fire + # before that version is on npm (deploy-pg-protocol.yml runs in + # parallel on the same merge commit). Workspace install would then + # fail at resolution. pg is plain JavaScript (no build step, no TS + # compile), so `npm publish` can pack the source files listed under + # the `files` field directly without resolving any dependencies. + defaults: + run: + working-directory: packages/pg steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -29,12 +41,9 @@ jobs: node-version: '20' registry-url: 'https://registry.npmjs.org' - - name: Install dependencies - run: yarn install --frozen-lockfile - # Ensure npm 11.5.1 or later is installed for trusted publishing support - name: Update npm run: npm install -g npm@latest - name: Publish to npm - run: cd packages/pg && npm publish + run: npm publish