Skip to content

fix(ci): replace sed version bump with npm version to prevent script corruption#125

Open
Kyzgor wants to merge 1 commit intopermitio:mainfrom
Kyzgor:fix/89-ci-version-bump-regex
Open

fix(ci): replace sed version bump with npm version to prevent script corruption#125
Kyzgor wants to merge 1 commit intopermitio:mainfrom
Kyzgor:fix/89-ci-version-bump-regex

Conversation

@Kyzgor
Copy link

@Kyzgor Kyzgor commented Mar 8, 2026

Summary

Replace the greedy sed regex in the CI publish workflow with npm version, and restore the corrupted version script in package.json.

Problem

The CI workflow (node_sdk_publish.yaml) uses sed -i "s/\"version\": \".*\"/.../" to bump the version before publishing. This regex matches every "version": "..." pattern in package.json — not just the top-level version field, but also the version script inside scripts.

This caused the version script to be silently corrupted from "standard-version" to the release version string (e.g., "2.5.2"). The corruption was introduced in commit 2abe31f and has persisted since.

Solution

  • Replace sed with npm version "$TAG" --no-git-tag-version --allow-same-version --ignore-scripts, which safely modifies only the top-level version field via npm's JSON-aware tooling
  • --no-git-tag-version prevents npm from creating a git commit and tag
  • --ignore-scripts prevents the version lifecycle script (standard-version) from running during the CI bump
  • Restore the version script in package.json from the corrupted "2.5.2" back to its original value: "standard-version"

Changes

  • .github/workflows/node_sdk_publish.yaml — replaced sed command with npm version
  • package.json — restored scripts.version from "2.5.2" to "standard-version"

Testing

Verified locally that npm version "X.Y.Z" --no-git-tag-version --allow-same-version --ignore-scripts:

  • Correctly updates only the top-level version field
  • Does not modify scripts.version
  • Does not trigger lifecycle scripts, create commits, tags, or changelogs

Backwards Compatibility

No breaking changes. The npm version command produces the same result (updated version field) without the side effect of corrupting other fields.

Fixes #89

…corruption

The CI workflow used `sed -i "s/\"version\": \".*\"/.../"`  to bump the
version in package.json before publishing. This greedy regex matched
every `"version": "..."` pattern in the file, including the `version`
script in the `scripts` block, corrupting it from `"standard-version"`
to the release version string.

Replace sed with `npm version --no-git-tag-version --allow-same-version`
which safely modifies only the top-level `version` field. Also restore
the corrupted `version` script to its original value.

Fixes permitio#89
@Kyzgor Kyzgor force-pushed the fix/89-ci-version-bump-regex branch from fb9c66a to a14220b Compare March 9, 2026 00:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CI workflow uses a regexp replace and changed the version script

1 participant