fix(cd): publish 13.0.0, and stop reporting success when nothing publishes (#537)

* chore(cd): log npm at verbose so OIDC failures explain themselves

The publish now fails with a bare ENEEDAUTH. npm's OIDC helper logs every failure path
at verbose, so at the default loglevel there is no way to tell a missing trusted
publisher from a permissions problem or a bad id_token:

  log.verbose('oidc', `Failed token exchange request with body message: ...`)
  log.verbose('oidc', 'Failed because token exchange was missing the token in the body')
  log.silly('oidc', 'Skipped because incorrect permissions for id-token ...')

Raising the loglevel makes the next run state the reason instead of us inferring it.

* fix(cd): fail the publish step when nothing gets published

Re-running an old CD run went green having shipped nothing. A workflow re-run checks out
the run's original commit, where the manifests still carried the pre-release versions, so
`lerna version` declined with an EBEHIND warning and exited 0, and every package then
looked already published and was skipped.

The publish script now exits non-zero when it publishes no packages, so that state fails
loudly instead of reporting success.

Author: ShaneK

.github/workflows/cd.yml

@@ -58,4 +58,8 @@ jobs:
         shell: bash
         env:
           NODE_AUTH_TOKEN: ''
+          # npm logs every OIDC token-exchange failure at verbose, so at the default
+          # loglevel a missing or mismatched trusted publisher just surfaces as
+          # ENEEDAUTH with no reason attached.
+          NPM_CONFIG_LOGLEVEL: verbose
 

scripts/publish-packages.sh

@@ -34,3 +34,16 @@ for manifest in packages/*/package.json; do
 done
 
 echo "published $published package(s)"
+
+# A run that publishes nothing is a failure, not a success. `lerna version` exits 0 when
+# it declines to version (an EBEHIND warning on a stale checkout, for example), which
+# leaves the manifests at their released versions and makes every package look already
+# published. Without this the job goes green having shipped nothing.
+if [ "$published" -eq 0 ]; then
+  echo "error: no packages were published." >&2
+  echo "The manifest versions above are already on the registry, so the Version step" >&2
+  echo "did not produce a new release. Check the Version step output rather than" >&2
+  echo "re-running this job: re-running a workflow checks out its original commit," >&2
+  echo "which still carries the pre-release versions." >&2
+  exit 1
+fi