[mike-ainsel]

pack-unpublished decides per package whether name@version is published, a new version, or a package npmjs does not have yet (the last is refused before any script runs, because a trusted publisher needs an existing package).

It assumed npm view name@version version exits 0 with no output for a missing version of an existing package. npm 10+ fails with E404 No match found for version instead — the same code as for a missing package — so every pending version was reported as not on npmjs yet. It hit runenv-python-3 (node-matrix-pnpm packs on GitHub-hosted runners with npm 11); block repos pack on hz runners with an older npm and were not affected.

Fix: on E404, run npm view <name> name; the package exists → new version, E404 → new package, anything else → error. npm < 10 keeps working (exit 0, no output → new version).

Tests: the fake registry now answers like npm 10+ by default; added a test for npm < 10 and one for the npmjs case. lib/ rebuilt.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking test gap for errors from the second lookup.

Findings

1.  Second lookup errors go untested ▶

Fix with agent prompt

### Issue 1
actions/node/npm-split-publish/src/registry.ts:72
The existing `failing` option fails the first lookup, so it never tests this new `CommandError` branch. Add a test where the version lookup returns `E404` and the package lookup returns `E500` or `E403`. Check that the second error is thrown with the package lookup command instead of being treated as a missing package.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR distinguishes a missing version from a missing package when npm returns E404.

• Registry checks distinguish new package versions from new packages.

Important touched types:

• VersionState: the three possible registry states: published, new-version, and new-package. Its definition is unchanged; the new lookup improves how the state is chosen.
• Runner: the function type used to run commands. Its definition is unchanged; versionState can now call it twice.
• RunResult: a command's exit code, standard output, and error output. Its definition is unchanged; the new isNotFound helper checks its output fields.
• CommandError: an error containing the failed command and its result. Its definition is unchanged; it now also reports failures from the package lookup.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A["Look up name@version"] --> B{"Exit code is zero?"}
  B -->|Yes| C{"Output has a version?"}
  C -->|Yes| D["published"]
  C -->|No| E["new-version"]
  B -->|No| F{"E404?"}
  F -->|No| G["Throw CommandError"]
  F -->|Yes| H["Look up package name"]
  H --> I{"Successful, nonempty output?"}
  I -->|Yes| E
  I -->|No| J{"Successful empty output or E404?"}
  J -->|Yes| K["new-package"]
  J -->|No| G

Loading

_{Reviews (1) · Last reviewed commit: "MILAB-7081: tell a new version from a ne..." · Reviewed by Greptile}

[notion-workspace]

[ci] review the NodeJS trusted publisher because they are going to enforce 2FA for access token

[greptile-apps]

Second lookup errors go untested

The existing failing option fails the first lookup, so it never tests this new CommandError branch. Add a test where the version lookup returns E404 and the package lookup returns E500 or E403. Check that the second error is thrown with the package lookup command instead of being treated as a missing package.

Prompt To Fix With AI

This is a comment left during a code review.
Path: actions/node/npm-split-publish/src/registry.ts
Line: 72

Comment:
**Second lookup errors go untested**

The existing `failing` option fails the first lookup, so it never tests this new `CommandError` branch. Add a test where the version lookup returns `E404` and the package lookup returns `E500` or `E403`. Check that the second error is thrown with the package lookup command instead of being treated as a missing package.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.