ci: shared-actions v2.4.0 — no npm cache on self-hosted, CI-only PRs skip the bump gate - #19
Merged
Merged
Conversation
…skip the bump gate validate-codebase (shared-actions#32): `cache: npm` on the self-hosted fleet was a restore miss plus a ~1 GB post-job upload of the shared ~/.npm on every lockfile-changing job, and an interrupted upload left a cache-save process spinning at 100 % CPU. v2.3.0 caches on GitHub-hosted runners only; the publish job's own setup-node loses the same flag here. verify-version-bump (shared-actions#33): PRs that touch only `.github/**` no longer need a package.json bump — nothing they change ships, so there is nothing to publish. This PR is the first such: no bump, no release.
robgilbreath
added a commit
that referenced
this pull request
Sep 3, 2026
npm publish over an existing version is a hard E403, so every merge to master that didn't bump package.json (Dependabot's, and CI-only PRs now that verify-version-bump exempts them) ended in a red publish run — run 33714086138 after #19. Look the version up first, as datto-rmm-api-client and timezest already do; the package is access: restricted, so the lookup uses the read-only NPM_TOKEN while the publish itself stays on OIDC trusted publishing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves
validate-codebaseandverify-version-bumpto shared-actions v2.4.0 (dfb52a3).validate-codebaseno longer passescache: npmon self-hosted runners. On the fleet~/.npmpersists between jobs, so the cache was a restore miss plus a ~1 GB post-job upload of the shared~/.npmon every lockfile-changing job (every Dependabot PR), and an interrupted upload leftcache-saveprocesses spinning at 100 % CPU on the runner host. Where this repo'snpm-publish.ymlruns its ownsetup-nodeon self-hosted, that step drops the same flag.verify-version-bumpexempts PRs that touch only.github/**from the bump gate. Nothing such a PR changes ships, so there is nothing to publish; the publish side still compares toHEAD^and skips. This PR is the first to use it: no version bump, no release.Public repos: both vendored
.github/actions/*copies resynced byte-for-byte (banner comment only). Tracked on pncit/.github#26.