pti/wraptool
Watch
1
0
Fork
You've already forked wraptool
 0
Code Issues 2 Pull requests Projects Releases 14 Packages 5 Wiki Activity Actions

fix: pass the source registry to npm ci for npm 12's allow-remote gate #116

Merged
pti merged 1 commit from fix/realize-npm12-allow-remote into main 2026-11-02 12:24:16 +01:00
Conversation 0 Commits 1 Files changed 8 +51 -27
pti commented 2026-11-02 12:08:59 +01:00
Owner

Unblocks the 0.10.0 release: ./release-version failed its test step on the host because npm 12 defaults allow-remote to none and only exempts a lockfile tarball whose origin is the configured registry. Realize's offline npm ci ran with npm's default registry, so the five realize integration tests, which serve tarballs from local httptest servers, failed with EALLOWREMOTE. Realize now passes --registry with the source's registry base URL, the gate stays on, and the tests put their tarballs on the same origin as the configured registry so they exercise the exemption like a real registry does. Reproduced and verified with npm_config_allow_remote=none on npm 11.17, full suite, vet and golangci-lint clean. Also adds the changelog entry under 0.10.0 and notes that 0.9.1 was never tagged. 🤖 Generated with Claude Code

Unblocks the 0.10.0 release: ./release-version failed its test step on the host because npm 12 defaults allow-remote to none and only exempts a lockfile tarball whose origin is the configured registry. Realize's offline npm ci ran with npm's default registry, so the five realize integration tests, which serve tarballs from local httptest servers, failed with EALLOWREMOTE. Realize now passes --registry with the source's registry base URL, the gate stays on, and the tests put their tarballs on the same origin as the configured registry so they exercise the exemption like a real registry does. Reproduced and verified with npm_config_allow_remote=none on npm 11.17, full suite, vet and golangci-lint clean. Also adds the changelog entry under 0.10.0 and notes that 0.9.1 was never tagged. 🤖 Generated with Claude Code
fix(pool): pass the source registry to npm ci so npm 12's allow-remote gate accepts locked tarballs
All checks were successful
Lint / lint (pull_request) Successful in 1m31s
Details
Lint / sonarqube (pull_request) Has been skipped
Details
e2aefba1c4 
npm 12 defaults `allow-remote` to `none` and exempts a lockfile tarball
only when its origin is the configured registry's. Realize's offline
`npm ci` ran with npm's default registry, so any lock whose "resolved"
URLs live elsewhere failed with EALLOWREMOTE before touching the cache.
The public registry matched by accident; the five realize integration
tests, which serve tarballs from httptest servers, failed on an npm 12
host and blocked `./release-version` for 0.10.0.

Realize now passes `--registry=<source registry>`; the gate stays on.
The tests put their tarballs on the same origin as the source's registry
(the registry server, or the closed-port fixture), so they exercise the
exemption the way a real registry does. Verified with
npm_config_allow_remote=none on npm 11.17, which reproduces the npm 12
default.

Also note in the changelog that 0.9.1 was never tagged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pti merged commit 0722b79461 into main 2026-11-02 12:24:16 +01:00
pti deleted branch fix/realize-npm12-allow-remote 2026-11-02 12:24:16 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
pti/wraptool!116
No description provided.