npm-publish latest does not work

[timea-solid]

I am working on an open source project which has the following CI: https://github.com/SolidOS/solid-logic/blob/main/.github/workflows/ci.yml

• I always publish a commit tag on any branch ( including main) upon push;
• when I push to main, it creates a latest in NPM )if it doe snot exist already).

Upon upgrade to version 4 of JS-DevTools/npm-publish -> the latest publish did not work anymore and teh log simply said: already published This is not correct, this version did not exist in NPM.

I downgraded to version 3.1.1 and it works again.

[mcous]

Hm that's unexpected. A cursory check of the comparison logic isn't showing me anything obvious, so I'll have to keep digging.

Looking at your CI setup, I recommend you move the first step "always publish a commit tag on any branch ( including main) upon push" to vanilla npm publish, because the only reason to use this action is for conditional publishing. If your publish is unconditional, there's no reason to use this action

[mcous]

Hi @timea-solid, I've investigated this issue further, and I suspect the cause to be a race-condition in your CI workflow that's tripping some new, apparantly faulty error-detection logic in npm-publish@v4 action

• I made a change in v4 to consider a 409 error during npm publish to mean "package is already published"
• I've just discovered that there are other reasons one can get a 409 during npm publish, for example:

  npm ERR! code E409
  npm ERR! 409 Conflict - PUT https://registry.npmjs.org/get-cli-arg - Failed to save packument. A common cause is if you try to publish a new package before the previous package has been fully processed.
  

• I forked solid-logic and have been completely unable to reproduce the issue

In my fork, I noticed that the two publish steps run concurrently. I wonder if you just got unlucky¹ with a race condition for your first couple attempts with v4. My suspicion: you got a 409 from npm publish due to a race between your latest and build-tag publish tasks, and the action erroneously thought the 409 meant that 3.1.0 was already in the registry.

If you update back to v4 and ensure your publish steps run sequentially, does your workflow run properly?

  npm-publish-build:
    needs: build
    runs-on: ubuntu-latest
    steps:
      # ...

  npm-publish-latest:
    needs: [build, npm-publish-build]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      # ...

I'm going to fix/tweak I have fixed the npm error code handling because that's an unambiguous bug, but I think it's downstream of the failure to publish rather than the cause

Alternative thoughts / musings:

• Maybe it's not a race at all, maybe it's something weird that happens with npm info if there are "too many" existing versions?

Footnotes

1. I think it's plausible that build changes in v4 - switching to ESM and using a different bundler - could've made the race easier to hit in your package, given how many discrete versions have been published. So "unlucky" is a simple term for a potentially complex interaction ↩

[timea-solid]

Thank you for looking into it.

First I updated to 4.1.0 - the problem persisted. Than I switched to make sure I do not publish concurrently, this helped.

[mcous]

Great, I checked your action logs and saw this error message from npm:

npm error code E409
npm error 409 Conflict - PUT https://registry.npmjs.org/chat-pane - Failed to save packument. A common cause is if you try to publish a new package before the previous package has been fully processed.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-09-23T14_33_23_335Z-debug-0.log

This confirms that the issue is a race condition due to concurrent publishing and not an issue in this action. Likely, one or more changes in v4 made this race condition easier to hit (newer Node runtime, different bundling process, ESM instead of CJS), but this race condition was present when you were using v3, too