fix(ci): resolve HOME before writing the registry token, unblocking main #505

Merged

gmackie merged 1 commit from fix/npmrc-home-on-runners into main

2026-08-27 21:42:02 +00:00

gmackie commented

2026-08-27 21:24:41 +00:00

Owner

main has not deployed since #499. Every deploy job is skipped because its test dependency fails with ERR_PNPM_FETCH_401 fetching @preflight/runreport.

The token was never missing. The FG_REGISTRY_TOKEN unset warning #499 added never fired, so the secret is present. These runners start without HOME, so "$HOME/.npmrc" wrote to /.npmrc, while pnpm resolved ~ through the passwd entry and read /root/.npmrc. The auth line landed somewhere nothing reads.

That is why the error is so misleading: pnpm reports "No authorization header was set" and then lists the @preflight:registry scope mapping — which reads like a missing secret rather than a file written to the wrong path.

This is the same HOME-less-runner gotcha release-agent.yml already works around (it burned a 30-minute release run earlier today). Applies the same resolution before the npmrc write, in all five places: ci.yml x2, deploy.yml x2, deploy-staging.yml.

Verified with scripts/test-workflow-yaml.mjs (added by #499) — 7 workflows parse cleanly.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CMpzX1b6swjezEptw3T71f

**main has not deployed since #499.** Every `deploy` job is skipped because its `test` dependency fails with `ERR_PNPM_FETCH_401` fetching `@preflight/runreport`. **The token was never missing.** The `FG_REGISTRY_TOKEN unset` warning #499 added never fired, so the secret is present. These runners start **without HOME**, so `"$HOME/.npmrc"` wrote to `/.npmrc`, while pnpm resolved `~` through the passwd entry and read `/root/.npmrc`. The auth line landed somewhere nothing reads. That is why the error is so misleading: pnpm reports *"No authorization header was set"* and then lists the `@preflight:registry` scope mapping — which reads like a missing secret rather than a file written to the wrong path. This is the same HOME-less-runner gotcha `release-agent.yml` already works around (it burned a 30-minute release run earlier today). Applies the same resolution before the npmrc write, in all five places: `ci.yml` x2, `deploy.yml` x2, `deploy-staging.yml`. Verified with `scripts/test-workflow-yaml.mjs` (added by #499) — 7 workflows parse cleanly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01CMpzX1b6swjezEptw3T71f

gmackie added 1 commit

2026-08-27 21:24:41 +00:00

fix(ci): resolve HOME before writing the registry token, unblocking main

CI / gitleaks (pull_request) Successful in 6s

Details

CI / storybook (pull_request) Successful in 1m43s

Details

forgegraph/ci CI passed

CI / ci (pull_request) Successful in 9m32s

Details

02029de013

Since #499 every deploy on main has been skipped because its `test`
dependency failed with ERR_PNPM_FETCH_401 on @preflight/runreport. The
token was present — the 'FG_REGISTRY_TOKEN unset' warning never fired —
but these runners start without HOME, so "$HOME/.npmrc" wrote to
/.npmrc while pnpm resolved ~ through the passwd entry and read
/root/.npmrc. The auth line went somewhere nothing looks, and pnpm
reported 'No authorization header was set' with the scope mapping
present, which reads like a missing secret rather than a missing file.

Resolves HOME the same way release-agent.yml already does, before the
npmrc write, in all five places (ci, deploy x2, deploy-staging).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CMpzX1b6swjezEptw3T71f

gmackie referenced this pull request

2026-08-27 21:31:54 +00:00

perf(alerts): look changesets up by id instead of hashing the whole table #506

gmackie merged commit a23d6c2d4c into main

2026-08-27 21:42:02 +00:00

gmackie referenced this pull request from a commit

2026-08-27 21:42:04 +00:00

fix(ci): resolve HOME before writing the registry token, unblocking main (#505)

gmackie referenced this pull request from a commit

2026-08-27 22:15:58 +00:00

fix(web): transpile @preflight/runreport, unblocking the deploy build

gmackie referenced this pull request