In npm-only mode (build-deb: false), the +N revision walks on every main merge, but npm has no +N concept — release.yml publishes the bare VERSION and skips if that version already exists.
So a merge that does not change VERSION still cuts a fresh draft (e.g. v4.8.0+2); when a human publishes it, the npm-exists guard fires and nothing publishes. The GitHub release UI shows a new published release while npm still serves the previous version — a release that looks shipped but isn't.
Mitigated in halos-org/skip#228 with a loud ::warning:: on the skip path + docs, but the draft is still created. Proposal: in npm-only mode, skip pre-release/draft creation (or clearly mark it non-publishing) when the upstream VERSION is unchanged since the last published npm version, so +N-only merges don't produce misleading releases.
Surfaced in the review of halos-org/skip#228 (adversarial, P2).
In npm-only mode (
build-deb: false), the+Nrevision walks on every main merge, but npm has no+Nconcept —release.ymlpublishes the bareVERSIONand skips if that version already exists.So a merge that does not change
VERSIONstill cuts a fresh draft (e.g.v4.8.0+2); when a human publishes it, the npm-exists guard fires and nothing publishes. The GitHub release UI shows a new published release while npm still serves the previous version — a release that looks shipped but isn't.Mitigated in halos-org/skip#228 with a loud
::warning::on the skip path + docs, but the draft is still created. Proposal: in npm-only mode, skip pre-release/draft creation (or clearly mark it non-publishing) when the upstreamVERSIONis unchanged since the last published npm version, so+N-only merges don't produce misleading releases.Surfaced in the review of halos-org/skip#228 (adversarial, P2).