[tomasr78]

Why

The "Check the package" step in publish.yml checks the tarball with tar -tzf "$TGZ" | grep -qx 'package/lib/index.js' under set -euo pipefail. That can fail at random and stop a release:

1. GNU tar writes the listing one line per write(). lib/index.js is entry 6 of 20, so tar still has 14 lines to write after it.
2. grep -q exits as soon as it matches.
3. tar's next write gets EPIPE. The runner ignores SIGPIPE, so tar prints tar: stdout: write error and exits 2.
4. pipefail fails the pipeline, and the || prints a false has no lib/index.js.

The same check failed this way in convertapi-library-js's main build on 2026-11-09 (run 42633356489, attempt 1).

Change

The step lists the tarball once into $RUNNER_TEMP/tgz-files.txt and greps that file. The error message is unchanged. A tarball that tar cannot read now stops the step with tar's own error.

Tested

In an Ubuntu 24.04 container (GNU tar 1.35, GNU grep 3.11, bash 5.2) with SIGPIPE ignored, as on the runner. The step's run: script was read from publish.yml and run with bash -euo pipefail against the package built from main (npm ci, npm run build, npm version 9.9.9-local.1, npm pack), with npm stubbed to hand over that tarball:

Case	main	this branch
Complete package, 500 runs	10 failed (tar: stdout: write error, then has no lib/index.js)	0 failed
Tarball without lib/index.js	exit 1, ::error::out/convertapi-9.9.9-local.1.tgz has no lib/index.js	same

publish.yml runs only on a release, so it was tested only as above.

Same fix in ConvertAPI/convertapi-library-js#31, where the race failed the build. The same defensive change, where nothing fails today: ConvertAPI/convertapi-library-python#65 and ConvertAPI/convertapi-library-java#61.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues are recorded for the release-workflow package-check change.

No open issues 🎉

What changed in this PR

This PR makes the release workflow’s package check more reliable by removing the tar | grep -q pipeline that can falsely report a missing file under pipefail.

Changes:

• Writes the tarball listing to a temporary file before checking for package/lib/index.js.
• Documents the race condition and preserves the existing missing-file error message.

File	Description
.github/​workflows/​publish.yml	Separates tarball listing from the grep check to prevent premature pipe closure from failing releases.

_{Review effort: Balanced}