[sentry-junior]

Stops master from going red after every release because package-lock.json falls behind the @sentry/cli-* optional dependency versions in package.json.

Until now, the release commit bumped package.json and a Craft post-release step bumped the lockfile later, once npm listed the new platform packages. That step depends on how fast npm lists them. @sentry/cli-linux-arm64 has been taking anywhere from about 15 minutes (3.8.1) to 56 minutes (3.8.2) to appear after publish. For 3.8.2 the 30-minute wait from #3451 ran out, so the lockfile never got bumped (fixed by hand in #3463).

bump-version.sh now writes the new version into the lockfile entries in the same release commit. Each entry gets only version and optional. These entries don't need npm to resolve anything, so they can be written before the packages exist. If a version isn't on npm yet, npm ci warns and skips that optional package instead of failing. The script exits if the lockfile is ever moved off lockfileVersion 1, so a format change can't silently skip the bump.

Since the lockfile is in sync from the start:

• scripts/post-release.sh and the postReleaseCommand in .craft.yml are removed. Craft skips the post-release step when the script is missing.
• Release-branch CI in test_node.yml now uses npm ci like everything else, without the npm install --omit=optional and napi-postinstall workaround. It also checks that the lockfile is in sync before publishing.

via @szokeasaurusrex.

--

View Junior Session [Sentry]