fix(ci): derive publish channel from trigger to end 409 race #74

Merged

David merged 2 commits from fix/GOV-14-trigger-derived-publish-channels into main

2026-06-22 18:10:38 +02:00

David commented

2026-06-20 13:15:09 +02:00

Owner

Background

Each build workflow (build-linux.yml, build-windows.yml) triggers on push to both branches: [main] and tags: [v*]. A release commit is simultaneously a push to main and the v* tag push, so both events fire. Both previously resolved the publish tag set from git describe via oci-build/get-tags.nu --joined, which on a tagged commit yields [<version>, latest] for BOTH events. The two runs then raced to DELETE-then-PUT the same immutable generic-package file at the <version> channel, producing intermittent 409 package file already exists and red release CI (GOV-13 / CLAUDE-122).

Fix

Resolve the publish channel from the workflow trigger instead of git describe, so the two events publish disjoint channels: a tag push (github.ref_type == 'tag') publishes the <version> channel; a push to main publishes only latest. This removes the concurrent writer on the immutable <version> file. latest still tracks the release commit because the tag sits on the same SHA pushed to main. This mirrors the change proven in CI on the monkey repo (PR #51).

The downstream publish and print steps already loop over the comma-split tags output and append no release-only channels of their own, so they needed no change. Neither workflow had release-only channel logic to preserve, so this is the minimal surgical edit (no get-tags --mode rewrite).

Files

.forgejo/workflows/build-linux.yml: trigger-derived channel in the Get tags step.
.forgejo/workflows/build-windows.yml: same edit, adapted to the yt-windows-x86_64.exe artifact (publish step unchanged).

Refs

GOV-14, GOV-13, CLAUDE-122.

## Background Each build workflow (`build-linux.yml`, `build-windows.yml`) triggers on `push` to both `branches: [main]` and `tags: [v*]`. A release commit is simultaneously a push to main and the `v*` tag push, so both events fire. Both previously resolved the publish tag set from `git describe` via `oci-build/get-tags.nu --joined`, which on a tagged commit yields `[<version>, latest]` for BOTH events. The two runs then raced to DELETE-then-PUT the same immutable generic-package file at the `<version>` channel, producing intermittent `409 package file already exists` and red release CI (GOV-13 / CLAUDE-122). ## Fix Resolve the publish channel from the workflow trigger instead of `git describe`, so the two events publish disjoint channels: a tag push (`github.ref_type == 'tag'`) publishes the `<version>` channel; a push to main publishes only `latest`. This removes the concurrent writer on the immutable `<version>` file. `latest` still tracks the release commit because the tag sits on the same SHA pushed to main. This mirrors the change proven in CI on the `monkey` repo (PR #51). The downstream publish and print steps already loop over the comma-split `tags` output and append no release-only channels of their own, so they needed no change. Neither workflow had release-only channel logic to preserve, so this is the minimal surgical edit (no get-tags `--mode` rewrite). ## Files - `.forgejo/workflows/build-linux.yml`: trigger-derived channel in the `Get tags` step. - `.forgejo/workflows/build-windows.yml`: same edit, adapted to the `yt-windows-x86_64.exe` artifact (publish step unchanged). ## Refs GOV-14, GOV-13, CLAUDE-122.

David added 1 commit

2026-06-20 13:15:10 +02:00

fix(ci): derive publish channel from trigger to end 409 race

Check / fmt + clippy + build + tests (pull_request) Successful in 20s

Details

8a4af12541

Each build workflow triggers on push to both `main` and `v*` tags. A release commit is simultaneously a push to main and the tag push, so both events fire. Both previously resolved the publish tag set from `git describe` (via `oci-build/get-tags.nu --joined`), which on a tagged commit yields `[<version>, latest]` for BOTH events. The two runs then raced to DELETE-then-PUT the same immutable generic-package file at the `<version>` channel, producing intermittent `409 package file already exists` and red release CI.

Resolve the publish channel from the workflow trigger instead: a tag push (`github.ref_type == 'tag'`) publishes the `<version>` channel; a push to main publishes only `latest`. The two events now write disjoint channels, so neither races on the immutable `<version>` file. `latest` still tracks the release commit because the tag sits on the same SHA pushed to main. Applied identically to the Linux and Windows workflows.

#GOV-14

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

David added 1 commit

2026-06-22 17:57:46 +02:00

Merge branch 'main' into fix/GOV-14-trigger-derived-publish-channels

Check / fmt + clippy + build + tests (pull_request) Successful in 1m58s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

78f1e72986