From 95124c1563d49b9bef3747308edaf862bff31e29 Mon Sep 17 00:00:00 2001
From: createitv <xfy150150@163.com>
Date: Tue, 13 Oct 2026 11:11:17 +0800
Subject: [PATCH] Fix unpublished npm version detection

---
 .github/workflows/npm.yml    | 21 ++++++++++++++-------
 scripts/test_npm_workflow.py | 15 +++++++++++++++
 2 files changed, 29 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
index b62708c..318d8f4 100644
--- a/.github/workflows/npm.yml
+++ b/.github/workflows/npm.yml
@@ -142,13 +142,20 @@ jobs:
           test "${#packages[@]}" -eq 1
           package=${packages[0]}
           candidate_integrity=$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync(process.argv[1],"utf8"))[0]; process.stdout.write(p.integrity)' "$RUNNER_TEMP/npm-artifact/npm-pack.json")
-          published_integrity=$(npm view "@createitv/agc-cli@$version" dist.integrity --json 2>/dev/null | tr -d '"\n' || true)
-          if test -n "$published_integrity"; then
-            test "$candidate_integrity" = "$published_integrity" || { echo "published npm package integrity differs from this release" >&2; exit 1; }
-            echo "@createitv/agc-cli@$version already matches the release; skipping immutable version."
-          else
-            npm publish "$package" --access public
-          fi
+          published_integrity=$(npm view "@createitv/agc-cli@$version" dist.integrity 2>/dev/null || true)
+          case "$published_integrity" in
+            sha512-*)
+              test "$candidate_integrity" = "$published_integrity" || { echo "published npm package integrity differs from this release" >&2; exit 1; }
+              echo "@createitv/agc-cli@$version already matches the release; skipping immutable version."
+              ;;
+            "")
+              npm publish "$package" --access public
+              ;;
+            *)
+              echo "unexpected npm integrity response: $published_integrity" >&2
+              exit 1
+              ;;
+          esac
       - name: Verify registry installation
         run: |
           version=${RELEASE_TAG#v}
diff --git a/scripts/test_npm_workflow.py b/scripts/test_npm_workflow.py
index 128760c..39e74e9 100644
--- a/scripts/test_npm_workflow.py
+++ b/scripts/test_npm_workflow.py
@@ -17,6 +17,21 @@ def test_setup_node_does_not_use_boolean_cache_value(self):
             "omit cache to disable it",
         )
 
+    def test_missing_version_does_not_turn_npm_json_error_into_integrity(self):
+        workflow = NPM_WORKFLOW.read_text(encoding="utf-8")
+
+        self.assertNotIn(
+            'dist.integrity --json',
+            workflow,
+            "npm view --json prints an error object to stdout for a missing "
+            "version, which must not be mistaken for an existing integrity",
+        )
+        self.assertIn(
+            'case "$published_integrity" in',
+            workflow,
+            "the workflow must only treat an sha512 integrity as published",
+        )
+
 
 if __name__ == "__main__":
     unittest.main()