Fail release metadata resolution on non-E404 npm view errors

[nakasyou]

Summary

fetchPublishedVersions in scripts/release/resolve-release-metadata.ts caught every npm view failure and returned []. That fallback is only right for an unpublished package; a registry 5xx / timeout / auth error made resolveVersionPlan treat an established package as unpublished and compute a from-scratch version (e.g. 0.0.1).

Now only E404 in npm's stderr maps to []; anything else throws with the stderr attached so the release fails loudly:

} catch (error) {
  if (isNpmNotFoundError(error)) return []   // /\bE404\b/.test(stderr)
  throw new Error(`Failed to fetch published versions for ${packageName}: ...`, { cause: error })
}

Verified against the live registry: an unknown package yields npm error code E404 (→ empty), while an unreachable registry yields no E404 (→ throws).

Remediates code scan finding sfind-c138261349c14d908bd99dcb300704a1.

Link to Devin session: https://app.devin.ai/sessions/30e809fe92844dd387188578fc56a4e4
Open in Devin Desktop: https://app.devin.ai/desktop/session/30e809fe92844dd387188578fc56a4e4?variant=devin
Requested by: @nakasyou

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Website preview: https://pr-130-eclipsa.xiarenda61.workers.dev

Commit: 6c9d18d

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.