From 44f4d8626e74540964a99281aecf7173938b6c47 Mon Sep 17 00:00:00 2001 From: MK Date: Thu, 9 Jul 2026 00:35:48 +0800 Subject: [PATCH 1/3] ci: bump registry-bridge action to content-addressed tarball URLs Point the preview-build action at pkg-pr-registry-bridge#58 (a83d8aa), which uploads tarballs content-addressed (/-/tarball///.tgz) and serves dist.tarball as /tarballs///.tgz. This fixes the ERR_PNPM_TARBALL_INTEGRITY a non-byte-reproducible rebuild of the same commit could cause: each build gets its own URL, so a republish can never cross bytes and integrity. The bridge is already deployed; this activates the new upload path for preview builds. --- .github/workflows/publish-preview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-preview.yml b/.github/workflows/publish-preview.yml index 6fdab28362..de78b0e37b 100644 --- a/.github/workflows/publish-preview.yml +++ b/.github/workflows/publish-preview.yml @@ -150,7 +150,7 @@ jobs: - name: Register commit build with the registry bridge id: bridge if: github.event.pull_request.head.repo.full_name == github.repository - uses: voidzero-dev/pkg-pr-registry-bridge@65c8157a6f44f075c50d3d3faf3a9bd43d2b230a # main + uses: voidzero-dev/pkg-pr-registry-bridge@a83d8aaac9f93918f5112eed3ec8e3b16afe401b # content-addressed tarball URLs (#58) with: sha: ${{ github.event.pull_request.head.sha }} admin-token: ${{ secrets.PKG_PR_BRIDGE_ADMIN_TOKEN }} From c5ae750b0eaf4cb036624621860d3138a966351a Mon Sep 17 00:00:00 2001 From: MK Date: Thu, 9 Jul 2026 00:40:35 +0800 Subject: [PATCH 2/3] ci: annotate the registry-bridge pin as # main (review feedback) --- .github/workflows/publish-preview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-preview.yml b/.github/workflows/publish-preview.yml index de78b0e37b..8d393a62a0 100644 --- a/.github/workflows/publish-preview.yml +++ b/.github/workflows/publish-preview.yml @@ -150,7 +150,7 @@ jobs: - name: Register commit build with the registry bridge id: bridge if: github.event.pull_request.head.repo.full_name == github.repository - uses: voidzero-dev/pkg-pr-registry-bridge@a83d8aaac9f93918f5112eed3ec8e3b16afe401b # content-addressed tarball URLs (#58) + uses: voidzero-dev/pkg-pr-registry-bridge@a83d8aaac9f93918f5112eed3ec8e3b16afe401b # main with: sha: ${{ github.event.pull_request.head.sha }} admin-token: ${{ secrets.PKG_PR_BRIDGE_ADMIN_TOKEN }} From a69ad5316d3f312b711000cc445b27dbecdf5c5f Mon Sep 17 00:00:00 2001 From: MK Date: Thu, 9 Jul 2026 09:39:09 +0800 Subject: [PATCH 3/3] ci: bump registry-bridge action pin to include per-package tarball URL logging (#60) --- .github/workflows/publish-preview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-preview.yml b/.github/workflows/publish-preview.yml index 8d393a62a0..18723e967a 100644 --- a/.github/workflows/publish-preview.yml +++ b/.github/workflows/publish-preview.yml @@ -150,7 +150,7 @@ jobs: - name: Register commit build with the registry bridge id: bridge if: github.event.pull_request.head.repo.full_name == github.repository - uses: voidzero-dev/pkg-pr-registry-bridge@a83d8aaac9f93918f5112eed3ec8e3b16afe401b # main + uses: voidzero-dev/pkg-pr-registry-bridge@4fbc4133d80536c36e4ce25aab3527da3645afc4 # main with: sha: ${{ github.event.pull_request.head.sha }} admin-token: ${{ secrets.PKG_PR_BRIDGE_ADMIN_TOKEN }}