Repository navigation
fix(release): publish packages serially to avoid provenance clashes - #5270
Merged
Merged
Conversation
Parallel lerna publish can fail with TLOG_CREATE_ENTRY_ERROR (409) when provenance attestations for independent packages are created concurrently. Publish one package at a time with --concurrency 1. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
glowcloud
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The latest release (1.13.0) was left partially published. The "Publish monorepo npm packages" step failed for
apidom-ns-api-design-systems,apidom-ns-openapi-3-2andapidom-parser-adapter-openapi-yaml-3-1with:lerna ERR! TLOG_CREATE_ENTRY_ERROR error creating tlog entry - (409) an equivalent entry already exists in the transparency log
This PR publishes with
--concurrency 1, so lerna publishes one package at a time and the provenance attestations are created one after another.Why
Lerna publishes independent packages in parallel, and each publish signs a provenance attestation and writes it to the Rekor transparency log. Creating these attestations concurrently is the suspected cause of the 409, because only a few packages failed. Publishing one package at a time tests that theory directly.
This is not proven. If the 409 still happens with serial publishing, the cause is something else.
Current state
The 1.13.0 release is partially published: some packages are at 1.13.0 and the rest are still at 1.12.1
Cost
Publishing takes longer, because each package is signed and uploaded one after another.
🤖 Generated with Claude Code