hubcio opened a new pull request, #3124: URL: https://github.com/apache/iggy/pull/3124
Releases must not push a git tag until the target registry is actually serving the artifact, and reruns must converge instead of leaving half-published state behind. Today cargo search is the availability oracle (rate-limited, laggy, and --limit 1 returns a relevance-ranked hit rather than an exact match), the foreign-SDK matrix pushes tags with no wait gate at all, and create-git-tag's early-skip silently accepts a pre-existing tag at the wrong commit. A new wait-for-crate composite queries the crates.io sparse index directly (CDN-fronted, unrate-limited, authoritative as of cargo publish return) and is reused at max_attempts=1 as the rust/post-merge idempotency pre-check so reruns skip already-published crates cleanly. A new wait-for-url composite gates every foreign-SDK tag step on HTTP 200 from its registry (PyPI, npm, Maven Central with ~25 min propagation budget, NuGet); Go stays tag-only. create-git-tag's early-skip now peels the remote ref and compares against the requested commit, so a wrong-target tag is a hard failure with recovery commands inline. The tag input regex now accepts semver build metadata. Plus smaller tightenings: env: indirection on every run block in rust/post-merge; dry_run kept there as a deprecated short- circuiting input so forks pinning by SHA do not silently start real-publishing; check-tags queries the remote; and _publish_rust_crates.yml requires non-empty inputs.commit instead of bypassing master-ancestry via a github.sha fallback. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
