"prepare" running, even with ignore

[Bugs5382]

Action Log:

Run JS-DevTools/npm-publish@v3.1.1
  with:
    provenance: true
    ignore-scripts: true
    token: ***
    tag: latest
  env:
    CLEAN_TAG: 0.1.0
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX
Error: NpmCallError: Call to "npm publish" exited with non-zero exit code 127
> @the-rabbit-hole/eslint-config@0.1.0 prepare
> husky

sh: 1: husky: not found
npm error code 127
npm error path /home/runner/work/eslint-config/eslint-config
npm error command failed
npm error command sh -c husky
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-09-14T02_40_27_891Z-debug-0.log

package.json:

  "scripts": {
    "prepare": "husky",
  },

Dev Depends:

  "devDependencies": {
    "@commitlint/cli": "^19.8.1",
    "@commitlint/config-conventional": "^19.8.1",
    "@types/eslint-plugin-jsx-a11y": "^6.10.0",
    "@types/eslint-plugin-tailwindcss": "^3.17.0",
    "@types/node": "^24.3.3",
    "eslint": "^9.35.0",
    "globals": "^16.4.0",
    "husky": "^9.1.7",
    "npm": "^11.6.0",
    "npm-package-json-lint": "^9.0.0",
    "npm-package-json-lint-config-default": "^8.0.1",
    "prettier": "3.6.2",
    "snazzy": "^9.0.0",
    "sort-package-json": "^3.4.0",
    "tsup": "^8.5.0"
  },

As far as I can tell, I am doing this right. here is my CI:

      - name: Publish to npm
        uses: JS-DevTools/npm-publish@v3.1.1
        with:
          provenance: true
          ignore-scripts: true
          token: ${{ secrets.NPM_TOKEN }}
          tag: ${{ steps.set-npm-tag.outputs.NPM_TAG }}

[mcous]

Hi @Bugs5382 - I believe this is a bug with npm itself that was only resolved in the v11.0.0 release. I am preparing the next major release of this action that will switch the action runtime to Node v24 + npm v11. Once it's out, I'll check back in here

[Bugs5382]

I guess I’ll put a pin in this as well. :) I thought I was going crazy.

[mcous]

v4.0.0 was just released, let me know if you see an improvement

[Bugs5382]

@mcous Thanks! I will try it out now. This was kinda of a blocker. 👍

[Bugs5382]

Run JS-DevTools/npm-publish@v4
  with:
    provenance: true
    token: ***
    tag: latest
  env:
    CLEAN_TAG: 0.1.0
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX
Error: NpmCallError: Call to "npm publish" exited with non-zero exit code 1
> @the-rabbit-hole/eslint-config@0.1.0 prepare
> husky || true

sh: 1: husky: not found
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access
npm error code EUSAGE
npm error Can't generate provenance for new or private package, you must set `access` to public.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-09-15T01_21_14_674Z-debug-0.log

I am now going to re-add ignore-scripts: true.

[Bugs5382]

Had to change my npm checkout to v5 and re-add the ignore-scripts: true. Added the public access which I didn't think of.

[mcous]

Oh odd, ignore-scripts: true should be the action's default behavior, so I wouldn't expect you to need to add it yourself. Let me make sure I didn't mess anything up there

[Bugs5382]

So... @mcous another package:

Run JS-DevTools/npm-publish@v4
  with:
    provenance: true
    ignore-scripts: true
    token: ***
    tag: latest
  env:
    CLEAN_TAG: 0.1.0
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX
  
Error: NpmCallError: Call to "npm publish" exited with non-zero exit code 127
> node-astronomy@0.1.0 prepare
> husky

sh: 1: husky: not found
npm error code 127
npm error path /home/runner/work/node-astronomy/node-astronomy
npm error command failed
npm error command sh -c husky
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-09-16T02_12_23_954Z-debug-0.log

This time it's public release. still same thing.

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: lts/*
          registry-url: 'https://registry.npmjs.org/'

      - name: Update Version in Package.json
        id: set-npm-tag
        run: |
          npm version $CLEAN_TAG --no-git-tag-version
          if [[ "$CLEAN_TAG" == *"beta"* ]]; then
            echo "NPM_TAG=beta" >> $GITHUB_OUTPUT
            echo "GIT_BRANCH_TARGET=develop" >> $GITHUB_OUTPUT
          else
            echo "NPM_TAG=latest" >> $GITHUB_OUTPUT
            echo "GIT_BRANCH_TARGET=main" >> $GITHUB_OUTPUT
          fi

      - name: Publish to npm
        uses: JS-DevTools/npm-publish@v4
        with:
          provenance: true
          ignore-scripts: true
          token: ${{ secrets.NPM_TOKEN }}
          tag: ${{ steps.set-npm-tag.outputs.NPM_TAG }}

This time I did not change "prepare" to "husky || true".

[mcous]

I think I've been making an incorrect assumption earlier in this thread: the action will, in fact, use the npm version from your setup-node action, not the action runtime!

Since your workflow is set to use lts/* (22), I think it's using npm 10, which has the bug. If you update setup-node to use version 24 (or do something like npm install -g npm@latest - not that I necessarily recommend this), I think the issue will be resolved

[Bugs5382]

Ok. Let me bump my conscripts to use node24 for deployment only.

[mcous]

@Bugs5382 did bumping to Node 24 resolve your issue?

Depending on your setup, you may also want to consider switching from using a third-party action like this one to calling run: npm publish yourself. There will be fewer moving parts and your workflow will be more secure if you limit publish to first-party tools