Publish Strips '+' Suffix From Version

[davertay-j]

Sometimes we use a re-publishing pattern where we append +1 to the version, e.g. 1.0.0+1.

When executing the publishJsPackageToGithubRegistry task, it appears the +1 suffix is stripped. Note that the packJsPackage works fine, it is the publish task only that seems to do this.

Note also that a suffix like -1 works fine, it seems only + is a problem.

Plugin Config

npmPublish {
    organization.set("testingstuff")
    version.set("${project.version}")

    registries {
        github {
            access.set(RESTRICTED)
            dry.set(true)
        }
    }

    packages {
        val js by getting {
            packageName.set("a-test")
        }
    }
}

Github Action

name: Publish
on:
  release:
    types:
      - published

jobs:
  publish:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-java@v3
        with:
          distribution: "adopt-hotspot"
          java-version: "11.0.11+9"

      - name: Publish Dump Info
        run: |
          env

      - name: PublishShowVer
        run: >
          echo
          "GITHUB_REF tag is: "
          -Pversion=${GITHUB_REF/refs\/tags\//}

      - name: Pack Npm
        run: >
          ./gradlew
          -Pversion="${GITHUB_REF/refs\/tags\//}"
          packJsPackage

      - name: Publish Npm
        run: >
          ./gradlew
          -Pversion="${GITHUB_REF/refs\/tags\//}"
          -Pnpm.publish.registry.github.authToken="test-token"
          publishJsPackageToGithubRegistry

Output For v1.0.3-1 ✅

GITHUB_REF tag is:  -Pversion=1.0.3-1

> Task :bridge: publishJsPackageToGithubRegistry
npm notice 📦  @testingstuff/[email protected]

Output For v1.0.2+1 ⛔

GITHUB_REF tag is:  -Pversion=1.0.2+1

> Task :bridge:publishJsPackageToGithubRegistry
npm notice 📦  @ testingstuff/[email protected]

Note the +1 suffix is missing on 1.0.2 ^^

[davertay-j]

@mpetuska I have a test repo setup to demonstrate the issue, let me know if you'd like access to that repo if it would help you debug.

[mpetuska]

Can you clarify which npm-publish version are you using?

[davertay-j]

Can you clarify which npm-publish version are you using?

3.0.0

[mpetuska]

Ah, in that case I suspect it's npm issue, given that it's not affecting pack tasks (which since 3.0.0 determine the version themselves as opposed to delegating to the npm)

[mpetuska]

More info here. I think even pack task does not work correctly, have a look at the package.json inside - it should have version trimmed as well.

[davertay-j]

Pack appears to work ok:

$ ./gradlew packJsPackage -Pversion=1.0.2+1
$ grep version bridge/build/packages/js/package.json 
  "version": "1.0.2+1",

I will check the node semver utility to see what it thinks.

[mpetuska]

I meant check the package.json file inside the generated .tgz file. Here's a quick refresher on task outputs:

• assemble: build/packages/js/**
• pack: build/packages/*.tgz

[mpetuska]

FYI, the plugin already handles x.y.z-SNAPSHOT versions correctly by replacing SNAPSHOT bit with a timestamp - x.y.z-1653681698

Maybe that alone would be sufficient for your needs?

[davertay-j]

The version inside the tgz is correct, and also shows "version": "1.0.2+1".

But you are probably correct that it is an npm problem, because the semver package strips it when parsing:

$ semver 1.0.0-1
1.0.0-1
$ semver 1.0.0+1
1.0.0

The semver specification allows for this but I suppose it is treated differently:
https://semver.org/#spec-item-10

We will have to stop using the + extensions I suppose. :-)

Thank you @mpetuska for finding that out!

[mpetuska]

Phew, I'm just glad that it's not a plugin issue 😆

[davertay-j]

Turns out it's a "feature" of npm, there is a request to correct it: npm/cli#4257

See also: npm/cli#1479

[mpetuska]

Lol, why am I not surprised?..