microsoft/typescript-go · error · Error

This task should not be run in non-release builds.

Error message

This task should not be run in non-release builds.

What it means

runSignNativePreviewPackages in Herebyfile.mjs (task `native-preview:sign-packages`, hidden from the task list) guards at entry: ESRP signing of the platform binaries is a release-only operation, so it throws immediately unless hereby was started with --forRelease. Signing involves Microsoft internal ESRP certs (Microsoft400, LinuxSign, MacDeveloperHarden) and must never run against local, non-release artifacts.

Source

Thrown at Herebyfile.mjs:2022

}

export const signNativePreviewPackages = task({
    name: "native-preview:sign-packages",
    hiddenFromTaskList: true,
    run: runSignNativePreviewPackages,
});

/**
 * @param {string} nodeOs
 */
function nativePreviewExeName(nodeOs) {
    const baseName = publishAsTypescript ? "tsc" : "tsgo";
    return nodeOs === "win32" ? `${baseName}.exe` : baseName;
}

async function runSignNativePreviewPackages() {
    if (!options.forRelease) {
        throw new Error("This task should not be run in non-release builds.");
    }
    if (usePublishedPlatformPackagesForVsix) {
        checkPublishedPlatformPackagesForVsix();
        console.log("Skipping npm package signing; VSIX packaging will use published platform packages.");
        return;
    }

    const platforms = getPlatforms();

    /** @type {Map<Cert, { tmpName: string; path: string }[]>} */
    const filelistByCert = new Map();
    for (const { npmDir, nodeOs, cert, npmDirName } of platforms) {
        let certFilelist = filelistByCert.get(cert);
        if (!certFilelist) {
            filelistByCert.set(cert, certFilelist = []);
        }
        certFilelist.push({
            tmpName: npmDirName,

View on GitHub (pinned to 1bcfa18d79)

Solutions

1. Run the full release pipeline instead: `npx hereby native-preview:release --forRelease --setPrerelease=dev.N.M`
2. If signing must run standalone, add the same flags: `npx hereby native-preview:sign-packages --forRelease --setPrerelease=dev.1.0`
3. Stop invoking hidden (`hiddenFromTaskList: true`) tasks outside the release pipeline; they are internal steps

Example fix

# before
npx hereby native-preview:sign-packages

# after
npx hereby native-preview:release --forRelease --setPrerelease=dev.1.0

// Verify release flags before spawning hereby
const args = process.argv.slice(2);
if (!args.includes("--forRelease")) {
  console.error("Signing tasks require --forRelease; aborting before invoke");
  process.exit(1);
}

When it happens

Trigger: Invoking the hidden signing task (or a custom task chain that calls runSignNativePreviewPackages) without the release flag, e.g. `npx hereby native-preview:sign-packages`.

Common situations: A developer or CI script experiments with release pipeline tasks by name instead of using the aggregate task; automation assembles task names dynamically and drops the flags.

Related errors

• Unknown cert: ${cert}
• usePublishedPlatformPackagesForVsix requires forRelease
• native-preview:release requires --forRelease and --setPrerel
• This task should not be run in release builds.
• Source file does not exist: ${src}

AI-assisted analysis of microsoft/typescript-go@1bcfa18d79 (2026-08-16). Data as JSON: /api/errors/2df5c00e1f056869. Report an issue: GitHub.