Fix the npm publish path; retry the staging tests after a pause

.github/workflows/build.yml

@@ -59,16 +59,23 @@ jobs:
             echo "::error::The CONVERTAPI_STAGING_TOKEN secret is not available to this run (a pull request from a fork gets no secrets)"
             exit 1
           fi
-          # The staging API now and then answers 503 (no healthy upstream), so each test gets two retries.
+          # The staging API answers 503 (no healthy upstream) in bursts of up to a minute, so each test gets
+          # two immediate retries and the whole suite up to three attempts, 30 s apart.
           npm run lint
-          npm run cover -- --retries 2
+          for attempt in 1 2 3; do
+            npm run cover -- --retries 2 && exit 0
+            echo "::warning::Attempt $attempt: the tests failed, see above"
+            sleep 30
+          done
+          echo "::error::The tests failed three times"
+          exit 1
 
       - name: Build
         run: npm run build
 
       # The examples call the production API and catch and print their own errors, so the preload points
-      # them at CONVERT_API_BASE_URI and any printed error fails an attempt. Up to three attempts, because
-      # the staging API now and then answers 503.
+      # them at CONVERT_API_BASE_URI and any printed error fails an attempt. Up to three attempts, 30 s apart,
+      # because the staging API answers 503 in bursts.
       - name: Run the examples
         env:
           API_TOKEN: ${{ secrets.CONVERTAPI_STAGING_TOKEN }}
@@ -80,7 +87,7 @@ jobs:
               exit 0
             fi
             echo "::warning::Attempt $attempt: an example failed, see the errors above"
-            sleep 10
+            sleep 30
           done
           echo "::error::The examples failed three times"
           exit 1

.github/workflows/publish.yml

@@ -144,10 +144,18 @@ jobs:
       - name: Lint and test
         env:
           CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_STAGING_TOKEN }}
-        # The staging API now and then answers 503 (no healthy upstream), so each test gets two retries.
+        # The staging API answers 503 (no healthy upstream) in bursts of up to a minute, so each test gets
+        # two immediate retries and the whole suite up to three attempts, 30 s apart.
         run: |
+          set -euo pipefail
           npm run lint
-          npm run cover -- --retries 2
+          for attempt in 1 2 3; do
+            npm run cover -- --retries 2 && exit 0
+            echo "::warning::Attempt $attempt: the tests failed, see above"
+            sleep 30
+          done
+          echo "::error::The tests failed three times"
+          exit 1
 
       - name: Set the version and build
         env:
@@ -187,7 +195,7 @@ jobs:
             echo "::error::No npm credentials: set up Trusted Publishing (NPM_TRUSTED_PUBLISHING) or the NPM_TOKEN secret"
             exit 1
           fi
-          npm publish "out/$PACKAGE-$VERSION.tgz" --provenance --access public --tag "$DIST_TAG" --ignore-scripts
+          npm publish "./out/$PACKAGE-$VERSION.tgz" --provenance --access public --tag "$DIST_TAG" --ignore-scripts
 
       # The registry usually serves a new version within seconds. A slow registry is not a failed release,
       # so this only warns.

CHANGELOG.md

@@ -3,7 +3,10 @@
 All notable changes to the `convertapi` npm package. Versions follow [Semantic Versioning](https://semver.org/);
 each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)).
 
-## 1.15.1 - 2026-10-20
+## 1.15.2 - 2026-10-20
+
+The first release from the new pipeline. v1.15.1 was tagged but never reached npm: its publish workflow
+passed the tarball as `out/...`, which npm reads as a GitHub repository.
 
 - Require axios 1.20.0 or later (was 1.6.2), which pulls in fixed follow-redirects and form-data. This
   closes the high and critical advisories in what `npm install convertapi` resolves, among them