Skip to content

CI Failure: npm publish blocked by Sigstore transparency log conflict (409) on @swc/plugin-noop@12.19.0 #653

Description

Problem Description

The Publish to npm workflow fails during release while publishing @swc/plugin-noop@12.19.0:

npm error code TLOG_CREATE_ENTRY_ERROR
npm error error creating tlog entry - (409) an equivalent entry already exists in the transparency log with UUID 108e9186e8c5677adcaf5d0b269f87f8be0c884b388fd377bb66205857943bdd515900038e30f938

The failure aborts the entire pnpm publish -r run, so the remaining packages never reach npm.

Expected Behavior

@swc/plugin-noop@12.19.0 is published to the npm registry.

Actual Behavior

Publishing aborts before the registry upload. Running npm view @swc/plugin-noop@12.19.0 returns 404 — the version was never published, but a Sigstore transparency log entry for its artifact already exists from an earlier failed run. Rekor is an immutable, append-only log (entries cannot be deleted), so every retry of the same artifact returns the same 409.

Suggested Fix

  • Bump @swc/plugin-noop to 12.20.0 (new artifact → new log entry), or
  • Publish 12.19.0 once without --provenance (ships without SLSA attestation).

I am sorry if this is wrong

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions