[npm][flake] You cannot publish over the previously published versions

[ianlewis]

Sometimes the local package.json version gets out of sync with the published versions.

npm verb stack HttpErrorGeneral: 403 Forbidden - PUT https://registry.npmjs.org/@slsa-framework%2fe2e-nodejs-push-main-disttag-slsa3 - You cannot publish over the previously published versions: 0.0.11.

I'm not sure how this happens because the package.json should be updated and pushed prior to the workflow that publishes the package being run. So even if there is an error in the workflow the version should be correct. Perhaps the old version is being rebased back on somehow?

[ianlewis]

Sometimes the tag push is accepted but the branch push is rejected because of a concurrent change and so the change to update the package.json gets lost.

https://github.com/slsa-framework/example-package/actions/runs/5441182527/jobs/9894851760

To https://github.com/slsa-framework/example-package.git
 * [new tag]           v36.0.92 -> v36.0.92
 ! [rejected]          main -> main (fetch first)
error: failed to push some refs to 'https://github.com/slsa-framework/example-package.git'
hint: Updates were rejected because the remote contains work that you do
hint: not have locally. This is usually caused by another repository pushing
hint: to the same ref. You may want to first integrate the remote changes
hint: (e.g., 'git pull ...') before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.