ci-validation-gates

To enforce valid semver in an npm publish pipeline, apply a validation gate to reject 4-part or malformed versions before publishing. This prevents invalid semantic versions from reaching the npm registry during automated releases.

Npm publish workflows fail in CI when using user tokens because they trigger 2FA prompts. You must verify token types and require automation tokens to ensure CI autonomy and block user tokens with 2FA requirements.

To handle npm registry propagation delays in GitHub Actions, implement retry logic with multiple verification attempts after publishing. This guards against eventual consistency issues when confirming successful package releases.

To prevent workflows from triggering on draft releases, configure pipelines to trigger only on release: published events and validate the release status via the GitHub API before proceeding with builds.

Yes, you can prevent unintended version mutations during npm release builds by setting the SKIP_BUILD_BUMP environment variable. This build script protection ensures deterministic delivery by blocking unintended version bumps.

Defensive CI/CD patterns for reliable npm package delivery include semver validation, token type verification, retry propagation, and draft release detection. These deterministic checks prevent faulty releases and outages.