From 11094230c404cf39f42196fbf53f7f4f99d87182 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 9 Jun 2026 20:21:59 +0000
Subject: [PATCH] fix(release): address provenance publish review

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 scripts/release-lib.sh       |  8 +++++++-
 scripts/release-lib.test.mjs | 23 ++++++++++++++++++++---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/scripts/release-lib.sh b/scripts/release-lib.sh
index 368f5695539..240725e3c9a 100644
--- a/scripts/release-lib.sh
+++ b/scripts/release-lib.sh
@@ -278,7 +278,7 @@ publish_package_to_npm() {
 
   publish_log="$(mktemp "${TMPDIR:-/tmp}/paperclip-npm-publish.XXXXXX")"
 
-  if pnpm publish --no-git-checks --tag "$dist_tag" --access public 2>&1 | tee "$publish_log"; then
+  if (set -o pipefail; pnpm publish --no-git-checks --tag "$dist_tag" --access public 2>&1 | tee "$publish_log"); then
     rm -f "$publish_log"
     return 0
   fi
@@ -296,6 +296,12 @@ publish_package_to_npm() {
     return 0
   fi
 
+  if [ "$dist_tag" != "canary" ]; then
+    release_warn "Not retrying ${package_name}@${package_version} without provenance for dist-tag ${dist_tag}."
+    rm -f "$publish_log"
+    return 1
+  fi
+
   release_warn "Retrying ${package_name}@${package_version} once with npm provenance disabled."
   if pnpm publish --no-git-checks --tag "$dist_tag" --access public --provenance=false; then
     rm -f "$publish_log"
diff --git a/scripts/release-lib.test.mjs b/scripts/release-lib.test.mjs
index 80ca4b7fd2f..fcaf52e6d12 100644
--- a/scripts/release-lib.test.mjs
+++ b/scripts/release-lib.test.mjs
@@ -11,7 +11,7 @@ function writeExecutable(path, body) {
   writeFileSync(path, body, { mode: 0o755 });
 }
 
-function runPublishHelper({ pnpmMode, npmVersionExists = false }) {
+function runPublishHelper({ pnpmMode, npmVersionExists = false, distTag = "canary", callerPipefail = true }) {
   const fixtureDir = mkdtempSync(join(tmpdir(), "paperclip-release-lib-"));
   const binDir = join(fixtureDir, "bin");
   const stateDir = join(fixtureDir, "state");
@@ -74,10 +74,11 @@ exit 1
 `,
   );
 
+  const shellOptions = callerPipefail ? "set -euo pipefail" : "set -eu";
   const script = `
-set -euo pipefail
+${shellOptions}
 source "${repoRoot}/scripts/release-lib.sh"
-publish_package_to_npm canary @paperclipai/example 1.2.3
+publish_package_to_npm ${distTag} @paperclipai/example 1.2.3
 `;
 
   let status = 0;
@@ -144,3 +145,19 @@ test("publish_package_to_npm does not retry unrelated publish failures", () => {
   assert.doesNotMatch(result.calls, /npm view/);
   assert.doesNotMatch(result.calls, /--provenance=false/);
 });
+
+test("publish_package_to_npm does not mask failures when caller has no pipefail", () => {
+  const result = runPublishHelper({ pnpmMode: "non-tlog-failure", callerPipefail: false });
+
+  assert.notEqual(result.status, 0);
+  assert.doesNotMatch(result.calls, /npm view/);
+  assert.doesNotMatch(result.calls, /--provenance=false/);
+});
+
+test("publish_package_to_npm does not retry stable publishes without provenance", () => {
+  const result = runPublishHelper({ pnpmMode: "tlog-then-success", distTag: "latest" });
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.calls, /^npm view @paperclipai\/example@1\.2\.3 version$/m);
+  assert.doesNotMatch(result.calls, /--provenance=false/);
+});