From b812c3ebede9066343866feae21358cfec1f7a07 Mon Sep 17 00:00:00 2001 From: Tomas Rutkauskas Date: Tue, 20 Oct 2026 11:10:38 +0300 Subject: [PATCH 1/2] Fix the npm publish path, retry the staging tests after a pause npm publish read out/convertapi-1.15.1.tgz as the GitHub shorthand out/convertapi-1.15.1.tgz, so v1.15.1 never reached npm; ./out/... is a file. The staging API answered 503 to four tests three times in a row, so the suite now gets up to three attempts 30 s apart on top of mocha's retries. CHANGELOG: the release is 1.15.2. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build.yml | 17 ++++++++++++----- .github/workflows/publish.yml | 14 +++++++++++--- CHANGELOG.md | 6 +++++- 3 files changed, 28 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d306fcd..73b5a40 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -59,16 +59,23 @@ jobs: echo "::error::The CONVERTAPI_STAGING_TOKEN secret is not available to this run (a pull request from a fork gets no secrets)" exit 1 fi - # The staging API now and then answers 503 (no healthy upstream), so each test gets two retries. + # The staging API answers 503 (no healthy upstream) in bursts of up to a minute, so each test gets + # two immediate retries and the whole suite up to three attempts, 30 s apart. npm run lint - npm run cover -- --retries 2 + for attempt in 1 2 3; do + npm run cover -- --retries 2 && exit 0 + echo "::warning::Attempt $attempt: the tests failed, see above" + sleep 30 + done + echo "::error::The tests failed three times" + exit 1 - name: Build run: npm run build # The examples call the production API and catch and print their own errors, so the preload points - # them at CONVERT_API_BASE_URI and any printed error fails an attempt. Up to three attempts, because - # the staging API now and then answers 503. + # them at CONVERT_API_BASE_URI and any printed error fails an attempt. Up to three attempts, 30 s apart, + # because the staging API answers 503 in bursts. - name: Run the examples env: API_TOKEN: ${{ secrets.CONVERTAPI_STAGING_TOKEN }} @@ -80,7 +87,7 @@ jobs: exit 0 fi echo "::warning::Attempt $attempt: an example failed, see the errors above" - sleep 10 + sleep 30 done echo "::error::The examples failed three times" exit 1 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index a2ce580..a592ebe 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -144,10 +144,18 @@ jobs: - name: Lint and test env: CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_STAGING_TOKEN }} - # The staging API now and then answers 503 (no healthy upstream), so each test gets two retries. + # The staging API answers 503 (no healthy upstream) in bursts of up to a minute, so each test gets + # two immediate retries and the whole suite up to three attempts, 30 s apart. run: | + set -euo pipefail npm run lint - npm run cover -- --retries 2 + for attempt in 1 2 3; do + npm run cover -- --retries 2 && exit 0 + echo "::warning::Attempt $attempt: the tests failed, see above" + sleep 30 + done + echo "::error::The tests failed three times" + exit 1 - name: Set the version and build env: @@ -187,7 +195,7 @@ jobs: echo "::error::No npm credentials: set up Trusted Publishing (NPM_TRUSTED_PUBLISHING) or the NPM_TOKEN secret" exit 1 fi - npm publish "out/$PACKAGE-$VERSION.tgz" --provenance --access public --tag "$DIST_TAG" --ignore-scripts + npm publish "./out/$PACKAGE-$VERSION.tgz" --provenance --access public --tag "$DIST_TAG" --ignore-scripts # The registry usually serves a new version within seconds. A slow registry is not a failed release, # so this only warns. diff --git a/CHANGELOG.md b/CHANGELOG.md index 3256bc2..e9edf7a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,11 @@ All notable changes to the `convertapi` npm package. Versions follow [Semantic Versioning](https://semver.org/); each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)). -## 1.15.1 - 2026-10-20 +## 1.15.2 - 2026-10-20 + +The first release from the new pipeline. v1.15.1 was tagged but never reached npm: its publish workflow +passed the tarball as `out/...`, which npm reads as a GitHub repository. + - Require axios 1.20.0 or later (was 1.6.2), which pulls in fixed follow-redirects and form-data. This closes the high and critical advisories in what `npm install convertapi` resolves, among them From 31ca45c36adeddab6aaea07de09e30268a419b91 Mon Sep 17 00:00:00 2001 From: Tomas Rutkauskas Date: Tue, 20 Oct 2026 11:10:49 +0300 Subject: [PATCH 2/2] CHANGELOG: drop a blank line Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9edf7a..7cbd4fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,7 +8,6 @@ each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)). The first release from the new pipeline. v1.15.1 was tagged but never reached npm: its publish workflow passed the tarball as `out/...`, which npm reads as a GitHub repository. - - Require axios 1.20.0 or later (was 1.6.2), which pulls in fixed follow-redirects and form-data. This closes the high and critical advisories in what `npm install convertapi` resolves, among them GHSA-jqh4-m9w3-8hp9, GHSA-fjxv-7rqg-78g4 and GHSA-r4q5-vmmm-2653.