From 072065cb16ff8e7e8f82e739a05305c1de08b6ec Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 17 Aug 2026 18:58:31 +0000 Subject: [PATCH] fix: prefix staged tarball path so npm does not treat it as git npm 11+ parses a bare packed/*.tgz argument as GitHub owner/repo shorthand, so npm stage publish ran git ls-remote against ssh://git@github.com/packed/docula-3.0.0.tgz.git and failed. Prefix the glob with ./ so npa treats it as a local file. Co-authored-by: Jared Wray --- .github/workflows/release.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 285e53d..45755b4 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -90,4 +90,7 @@ jobs: run: sfw npm install --global npm@11.19.0 - name: Stage publish - run: npm stage publish packed/*.tgz --access public --provenance + # Prefix with ./ so npm treats the tarball as a local file. A bare + # packed/*.tgz path is parsed as GitHub owner/repo shorthand (npm npa), + # which then fails with git ls-remote Permission denied (publickey). + run: npm stage publish ./packed/*.tgz --access public --provenance