fix(ci): prevent false-success publish + force sync to origin/master

Author: adamhenson

.github/workflows/publish.yml

@@ -6,11 +6,16 @@ on:
 
 jobs:
   publish:
+    concurrency:
+      group: publish
+      cancel-in-progress: false
     runs-on: ubuntu-latest
     env:
       PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - name: Setup Node
         uses: actions/setup-node@v4
         with:

packages/foo-api-ci-tools/dist/git.js

@@ -11,8 +11,10 @@ export const config = () => {
 
 export const checkout = (branch = 'master') => {
   shell(`git remote set-url origin ${GIT_URL}`);
-  shell('git fetch');
-  shell(`git checkout ${branch} && git pull`);
+  // Ensure we are exactly at the remote head (no shallow/merge weirdness in CI)
+  shell(`git fetch --tags --prune origin ${branch}`);
+  shell(`git checkout ${branch}`);
+  shell(`git reset --hard origin/${branch}`);
 };
 
 export const add = () => {

packages/foo-api-ci-tools/dist/git.js.map

@@ -4,12 +4,19 @@ export default (command: string) => {
   const result = shell.exec(command);
   const isGrep = command.includes('grep');
   const isGitCommit = command.includes('git commit');
+  const isLernaPublish = command.includes('lerna publish');
 
   // for some reason grep commands can return exit code `123`
   // when nothing was returned (and everything is fine)
   if (!isGitCommit && result.code !== 0 && (!isGrep || result.code !== 123)) {
     throw Error(result.stderr);
   }
 
+  // Lerna can sometimes exit 0 while still refusing to publish (e.g. EBEHIND).
+  // Treat that as a hard failure so CI doesn't falsely report success.
+  if (isLernaPublish && (result.stderr || '').includes('EBEHIND')) {
+    throw Error(result.stderr);
+  }
+
   return result.stdout;
 };