ci: Surface errors on bump-versions and similiar scripts (#36479)

.github/scripts/bump-versions.mjs

@@ -5,6 +5,7 @@ import { resolve } from 'path';
 import child_process from 'child_process';
 import { promisify } from 'util';
 import assert from 'assert';
+import { getMonorepoProjects } from './pnpm-utils.mjs';
 
 const exec = promisify(child_process.exec);
 
@@ -184,13 +185,7 @@ async function bumpVersions() {
 		releaseType === 'experimental'
 			? (await exec('git rev-parse --short=8 HEAD')).stdout.trim()
 			: undefined;
-	const packages = JSON.parse(
-		(
-			await exec(
-				`pnpm ls -r --only-projects --json | jq -r '[.[] | { name: .name, version: .version, path: .path,  private: .private}]'`,
-			)
-		).stdout,
-	);
+	const packages = await getMonorepoProjects();
 
 	/** @type {Record<string, { path: string, isDirty: boolean, version: string, nextVersion?: string }>} */
 	const packageMap = {};
@@ -290,5 +285,10 @@ async function bumpVersions() {
 
 // only run when executed directly, not when imported by tests
 if (import.meta.url === `file://${process.argv[1]}`) {
-	bumpVersions();
+	try {
+		await bumpVersions();
+	} catch (error) {
+		console.error(error);
+		process.exit(1);
+	}
 }

.github/scripts/detect-new-packages.mjs

@@ -14,19 +14,10 @@
  *   1 – One or more public packages have never been published
  */
 
-import child_process from 'child_process';
-import { promisify } from 'util';
 import { writeGithubOutput } from './github-helpers.mjs';
+import { getMonorepoProjects } from './pnpm-utils.mjs';
 
-const exec = promisify(child_process.exec);
-
-const packages = JSON.parse(
-	(
-		await exec(
-			`pnpm ls -r --only-projects --json | jq -r '[.[] | { name:.name, private: .private}]'`,
-		)
-	).stdout,
-);
+const packages = await getMonorepoProjects();
 
 const newPackages = [];
 

.github/scripts/ensure-provenance-fields.mjs

@@ -1,21 +1,12 @@
 import { writeFile, readFile, copyFile } from 'fs/promises';
 import { resolve, dirname } from 'path';
-import child_process from 'child_process';
 import { fileURLToPath } from 'url';
-import { promisify } from 'util';
-
-const exec = promisify(child_process.exec);
+import { getMonorepoProjects } from './pnpm-utils.mjs';
 
 const commonFiles = ['LICENSE.md', 'LICENSE_EE.md'];
 
 const baseDir = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
-const packages = JSON.parse(
-	(
-		await exec(
-			`pnpm ls -r --only-projects --json | jq -r '[.[] | { name: .name, version: .version, path: .path,  private: .private}]'`,
-		)
-	).stdout,
-);
+const packages = await getMonorepoProjects();
 
 for (let { name, path, version, private: isPrivate } of packages) {
 	if (isPrivate) continue;

.github/scripts/pnpm-utils.mjs

@@ -1,7 +1,7 @@
 import child_process from 'child_process';
 import { promisify } from 'node:util';
 
-const exec = promisify(child_process.exec);
+const execFile = promisify(child_process.execFile);
 
 /**
  * @typedef PnpmPackage
@@ -15,11 +15,28 @@ const exec = promisify(child_process.exec);
  * @returns { Promise<PnpmPackage[]> }
  * */
 export async function getMonorepoProjects() {
-	return JSON.parse(
-		(
-			await exec(
-				`pnpm ls -r --only-projects --json | jq -r '[.[] | { name: .name, version: .version, path: .path,  private: .private}]'`,
-			)
-		).stdout,
-	);
+	let stdout;
+
+	// No shell and no `| jq`: a pipeline hides pnpm's exit code (jq exits 0 on
+	// empty input), which turns a failing pnpm into an empty package list.
+	try {
+		({ stdout } = await execFile('pnpm', ['ls', '-r', '--only-projects', '--json'], {
+			// Unprojected output is ~600KB and grows with the workspace.
+			maxBuffer: 64 * 1024 * 1024,
+		}));
+	} catch (error) {
+		const details = error.stderr?.trim() || error.message;
+		throw new Error(`\`pnpm ls -r --only-projects --json\` failed: ${details}`);
+	}
+
+	if (!stdout.trim()) {
+		throw new Error('`pnpm ls -r --only-projects --json` produced no output');
+	}
+
+	return JSON.parse(stdout).map(({ name, version, path, private: isPrivate }) => ({
+		name,
+		version,
+		path,
+		private: Boolean(isPrivate),
+	}));
 }

.github/workflows/release-create-pr.yml

@@ -89,8 +89,16 @@ jobs:
           corepack enable
 
       - name: Bump package versions
+        # Assign first: a command substitution nested in another command's
+        # arguments (e.g. `echo "X=$(node …)"`) discards the script's exit code.
+        shell: bash
         run: |
-          echo "NEXT_RELEASE=$(node .github/scripts/bump-versions.mjs)" >> "$GITHUB_ENV"
+          NEXT_RELEASE="$(node .github/scripts/bump-versions.mjs)"
+          if [ -z "$NEXT_RELEASE" ]; then
+            echo "::error::bump-versions.mjs produced no version"
+            exit 1
+          fi
+          echo "NEXT_RELEASE=$NEXT_RELEASE" >> "$GITHUB_ENV"
         env:
           RELEASE_TYPE: ${{ inputs.release-type }}