ci(release): skip npm packages an earlier attempt already staged

[Mikola Lysenko (mikolalysenko)]

Why

5.0.1's main npm package (@socketsecurity/socket-patch) never staged: the release run got E401 on it after its publisher was fixed. The npm-only retry (run 38449949240) then failed on the first platform package with 409 Cannot stage previously published version "5.0.1", because the 14 platform packages were already staged.

The "already staged" fallback runs npm stage list. That can't authenticate in CI, because the OIDC exchange only happens on publish. So the job never reached the main package.

What

Both stage steps in release.yml's npm-publish job now use one inline stage() helper. If the version is already published, it skips. If the registry answers with that 409 message, it counts the package as staged and moves on. Any other failure still fails the step.

The helper is inline, not a script, because the job checks out the release tag (v5.0.1), which doesn't have any new script.

After merge

Actions → Release → npm-retry-version: 5.0.1 stages @socketsecurity/socket-patch@5.0.1 from CI, with signed provenance like the platform packages got. Then approve it with 2FA after the 14 platform packages.

actionlint on release.yml passes.

🤖 Generated with Claude Code

---

Note

Low Risk
Release workflow-only change to npm staging retry behavior; no runtime or registry credential changes beyond skipping known 409/published cases.

Overview
The npm-publish job’s platform and main stage-publish steps now share an inline stage() helper that makes partial retries idempotent.

Instead of treating npm stage list as the “already staged” signal (which fails in CI because OIDC only runs on publish), a failed npm stage publish is skipped when npm view shows the version is already live, or when registry output contains Cannot stage previously published version (409 for a staged-but-unapproved version). Those packages are still recorded in staged-packages.txt; any other error still fails the step. The helper stays inline so npm-retry-version runs work when the job checks out an older release tag.

^{Reviewed by Cursor Bugbot for commit e226d75. Configure here.}