From 2015040026d384af20bca11470cc68fe12e9dfed Mon Sep 17 00:00:00 2001 From: Kanav Jain Date: Tue, 28 Jul 2026 16:31:29 -0500 Subject: [PATCH 1/2] fix(ci): repair the scheduled observation workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daily run has failed every day since at least 2026-07-25, all at the same line: `observations/Bitcoin.json: No such file or directory`. The directory is not in the repo and nothing created it, so the redirect failed under `bash -e` before the CLI ever ran. Four fixes, three of which would have surfaced only after the first: - `mkdir -p observations` before the loop. - The commit step ran `git diff --quiet` after `git add`, which compares the worktree to the index and is therefore always quiet. It would have reported "No changes" and committed nothing, forever. Use `git diff --cached --quiet`. - Analysis wrote with `2>&1`, folding progress messages ("Analyzing…", "Fetched 20 revisions.") into the JSON file. Every committed observation would have been unparseable. Write to `$RUNNER_TEMP` and move only on success, so a failed analysis leaves no artifact. - The `pages` input was interpolated into the shell via `${{ }}`. Pass it through `env:` instead. Also declares `permissions: contents: write`, which the push step needs and never reached. Co-Authored-By: Claude Opus 5 --- .github/workflows/observe.yml | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/.github/workflows/observe.yml b/.github/workflows/observe.yml index 75b9e99..c449955 100644 --- a/.github/workflows/observe.yml +++ b/.github/workflows/observe.yml @@ -10,6 +10,9 @@ on: required: true default: "Bitcoin COVID-19" +permissions: + contents: write + jobs: observe: runs-on: ubuntu-latest @@ -24,12 +27,24 @@ jobs: run: bun install --frozen-lockfile && bun run build - name: Run refract analysis + env: + # Via env rather than ${{ }} interpolation, so a page title cannot + # break out of the string and become shell. + PAGES: ${{ github.event.inputs.pages || 'Bitcoin' }} run: | - PAGES="${{ github.event.inputs.pages || 'Bitcoin' }}" + mkdir -p observations for PAGE in $PAGES; do echo "=== Observing: $PAGE ===" - node packages/cli/dist/src/cli.js analyze "$PAGE" --depth detailed --json \ - > "observations/${PAGE//\//_}.json" 2>&1 + # Analysis output goes to a temp file first: folding stderr into the + # JSON would commit an error message as though it were an + # observation, and a partial write on failure is worse than none. + if node packages/cli/dist/src/cli.js analyze "$PAGE" --depth detailed --json \ + > "$RUNNER_TEMP/observation.json"; then + mv "$RUNNER_TEMP/observation.json" "observations/${PAGE//\//_}.json" + else + echo "::error::analysis failed for $PAGE" + exit 1 + fi done - name: Commit observations @@ -37,7 +52,7 @@ jobs: git config user.name "refract-bot" git config user.email "bot@refract-org.github.io" git add observations/ - git diff --quiet && echo "No changes" || { + git diff --cached --quiet && echo "No changes" || { git commit -m "chore: daily observation $(date -u +%Y-%m-%d)" git push } From 8658baa6315d5f72c528350d4562e9c7d2dfcf40 Mon Sep 17 00:00:00 2001 From: Kanav Jain Date: Tue, 28 Jul 2026 16:37:42 -0500 Subject: [PATCH 2/2] fix(ci): make package publishing actually publish MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm's latest `@refract-org/cli` is 0.5.7, published 2026-05-18. The repo is at 0.5.13. Nothing has landed on npm in 71 days, and the reason is entirely in this workflow. `npm publish` resolved to the bun-backed shim that setup-bun puts ahead of Node's npm in PATH. Bun's implementation has no OIDC token exchange, so v0.5.8 through v0.5.11 all died with: error: missing authentication (run `bunx npm login`) v0.5.12 then reported **success** while every package failed: npm error 404 Not Found - PUT https://registry.npmjs.org/@refract-org%2fcli `|| true` swallowed it. The tag looked released and was not. Three changes: - Resolve npm from the Node toolchain by path, bypassing the shim. - Drop `|| true`, so a 404 fails the run instead of being reported green. - Drop `bun test || echo "publishing anyway"`. A publish that ignores its own test results is how a broken tarball reaches users. Also threads `NODE_AUTH_TOKEN` through, so a repo secret works as a fallback where OIDC trusted publishing is not configured. Note: this does not by itself fix authentication. The 404-on-PUT means npm is rejecting the write, so trusted publishing still has to be configured on npmjs.com for each package, or an NPM_TOKEN secret added — the repo currently has no secrets set. What this change guarantees is that the next failure is visible. Co-Authored-By: Claude Opus 5 --- .github/workflows/publish.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index cce474c..00f13b6 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,15 +24,25 @@ jobs: - run: bun install --frozen-lockfile - run: bun run build - - run: bun test || echo "Tests had failures — publishing anyway" + - run: bun test - name: Publish packages + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} run: | - npm --version - # npm 10+ auto-exchanges OIDC token when --provenance is used + # Resolve npm from the Node toolchain explicitly. setup-bun puts a + # bun-backed `npm` earlier in PATH, and bun's implementation does not + # support OIDC token exchange — it fails with + # "missing authentication (run `bunx npm login`)", which is what killed + # every publish from v0.5.8 to v0.5.11. + NPM="$(dirname "$(which node)")/npm" + "$NPM" --version + for pkg in packages/evidence-graph packages/ingestion packages/analyzers packages/cli packages/eval; do - echo "Publishing $pkg..." - cd $pkg - npm publish --access public --provenance || npm publish --access public || true - cd $OLDPWD + echo "::group::Publishing $pkg" + # No `|| true`. A failed publish must fail the run: v0.5.12 reported + # success while every package 404'd on PUT (npm's response to an + # unauthorized write), so the tag looked released and was not. + ( cd "$pkg" && "$NPM" publish --access public --provenance ) + echo "::endgroup::" done