From 1c4236e37dae3f317ec6a68d9d1aed50035ff0ac Mon Sep 17 00:00:00 2001
From: mcollinscodat <m.collins@codat.io>
Date: Thu, 27 Aug 2026 15:21:07 +0100
Subject: [PATCH] fix/CONN-1691-npm-publish-stale-tarball: clear the publish
 stage's download folders so a leftover tarball can't be read

- .azuredevops/npm-publish.yml - remove pack-out and release-facts before the artifact downloads, fail unless pack-out holds exactly one .tgz, and publish that named file instead of ./*.tgz
---
 .azuredevops/npm-publish.yml | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/.azuredevops/npm-publish.yml b/.azuredevops/npm-publish.yml
index 258ca840d..cd9c19290 100644
--- a/.azuredevops/npm-publish.yml
+++ b/.azuredevops/npm-publish.yml
@@ -329,6 +329,17 @@ stages:
             inputs:
               version: $(nodeVersion)
 
+          # DownloadPipelineArtifact does not empty its target directory, and
+          # Pipeline.Workspace survives between runs on a reused agent, so a
+          # previous release's tarball can still be sitting in pack-out.
+          - task: Bash@3
+            displayName: "Clear the download folders from any earlier run"
+            inputs:
+              targetType: inline
+              script: |
+                set -euo pipefail
+                rm -rf "$(Pipeline.Workspace)/pack-out" "$(Pipeline.Workspace)/release-facts"
+
           - task: DownloadPipelineArtifact@2
             displayName: "Download the packed tarball"
             inputs:
@@ -389,7 +400,15 @@ stages:
               workingDirectory: $(Pipeline.Workspace)/pack-out
               script: |
                 set -euo pipefail
-                tgz=$(ls *.tgz)
+                shopt -s nullglob
+                tarballs=(*.tgz)
+                if [ "${#tarballs[@]}" -ne 1 ]; then
+                  echo "##[error]Expected exactly one .tgz in pack-out, found ${#tarballs[@]}: ${tarballs[*]:-none}"
+                  ls -la
+                  exit 1
+                fi
+                tgz="${tarballs[0]}"
+                echo "##vso[task.setvariable variable=tarball]$tgz"
                 manifest=$(tar -xzOf "$tgz" package/package.json)
                 # Name and version come from the tarball, so this stage needs no
                 # variable handed across from the build stage.
@@ -443,7 +462,7 @@ stages:
                   echo "Version already on npm — skipping publish."
                   exit 0
                 fi
-                npm publish ./*.tgz --access public --tag $(distTag)
+                npm publish "./$(tarball)" --access public --tag $(distTag)
 
           # Last, so a tag only ever exists for a version that really published.
           # Matches Speakeasy's tag and title shape so changelogs keep working.