From e6192117fb7405213986cae0c793329f017c5be4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mikl=C3=B3s=20Fazekas?= <mfazekas@szemafor.com>
Date: Wed, 22 Jul 2026 17:52:36 +0200
Subject: [PATCH] ci: scheduled check that latest GitHub release is published
 on npm

Daily audit comparing the latest GitHub release against npm; opens an
issue (deduped by title) when the release version is missing from the
registry. Catches publish failures even when the publish workflow never
ran, e.g. the v10.3.3/v10.3.4 EBADENGINE failures that went unnoticed.
---
 .github/workflows/check-npm-publish.yml | 33 +++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/check-npm-publish.yml

diff --git a/.github/workflows/check-npm-publish.yml b/.github/workflows/check-npm-publish.yml
new file mode 100644
index 000000000..32a097cfc
--- /dev/null
+++ b/.github/workflows/check-npm-publish.yml
@@ -0,0 +1,33 @@
+name: Check NPM Publish
+on:
+  schedule:
+    - cron: '30 6 * * *'
+  workflow_dispatch:
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Verify latest GitHub release is on npm
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          tag=$(gh api "repos/$GITHUB_REPOSITORY/releases/latest" --jq .tag_name)
+          version=${tag#v}
+          if npm view "@rnmapbox/maps@$version" version > /dev/null 2>&1; then
+            echo "npm has @rnmapbox/maps@$version"
+            exit 0
+          fi
+          echo "::error::Release $tag exists on GitHub but @rnmapbox/maps@$version is not on npm"
+          title="npm publish missing for $tag"
+          existing=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open --search "\"$title\" in:title" --json number --jq '.[0].number')
+          if [ -n "$existing" ]; then
+            echo "Issue #$existing already open"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" \
+              --title "$title" \
+              --body "The latest GitHub release [\`$tag\`](${{ github.server_url }}/$GITHUB_REPOSITORY/releases/tag/$tag) is not published on npm (\`npm view @rnmapbox/maps@$version\` finds nothing). The publish workflow may have failed or never run. Detected by the scheduled Check NPM Publish workflow."
+          fi
+          exit 1