VA-51: make generic package upload idempotent on 409 #53

Merged

nrupard merged 1 commit from fix/VA-51-generic-upload-idempotent into main

2026-06-08 23:17:41 +02:00

nrupard commented

2026-06-08 23:08:53 +02:00

Owner

Problem

build-package.yml uploads the agent binary and checksum to the Forgejo generic package registry with curl --fail. The generic registry never overwrites an existing file: a duplicate PUT returns 409 Conflict ("A file with the same name exist already in the package"), and --fail turns that into exit 22, failing the job. Run #179 (commit ef8cad3) failed this way, as did #173.

The collision is expected, not a fluke. oci-build/get-version.nu collapses an exact v* tag (vX.Y.Z-0-g<sha>) to a bare X.Y.Z. During VA-49 the v0.1.0 tag was re-pointed onto the current main HEAD, so a push to main now describes to v0.1.0-0-gef8cad3 -> version 0.1.0, the same version the tag-push run already published. Any push that lands on a tagged commit, or any plain re-run of the workflow, re-attempts the identical upload and 409s.

Fix

A published release artifact is immutable, so re-uploading the same version should be a no-op rather than a hard failure. The upload step now drops --fail, captures the HTTP status with curl --write-out "%{http_code}", and branches:

201 -> freshly published
409 -> already published at this version, skip
anything else -> real error, fail the step

This keeps genuine failures (auth, 400, 5xx, transport) fatal while making release re-runs and tag-on-HEAD main pushes succeed idempotently. Branch logic validated against nu 0.112.2.

Reference: https://forgejo.org/docs/latest/user/packages/generic/ (201 / 400 / 409 semantics).

#VA-51

## Problem `build-package.yml` uploads the agent binary and checksum to the Forgejo generic package registry with `curl --fail`. The generic registry never overwrites an existing file: a duplicate PUT returns `409 Conflict` ("A file with the same name exist already in the package"), and `--fail` turns that into exit 22, failing the job. Run #179 (commit ef8cad3) failed this way, as did #173. The collision is expected, not a fluke. `oci-build/get-version.nu` collapses an exact `v*` tag (`vX.Y.Z-0-g<sha>`) to a bare `X.Y.Z`. During VA-49 the `v0.1.0` tag was re-pointed onto the current main HEAD, so a push to main now describes to `v0.1.0-0-gef8cad3` -> version `0.1.0`, the same version the tag-push run already published. Any push that lands on a tagged commit, or any plain re-run of the workflow, re-attempts the identical upload and 409s. ## Fix A published release artifact is immutable, so re-uploading the same version should be a no-op rather than a hard failure. The upload step now drops `--fail`, captures the HTTP status with `curl --write-out "%{http_code}"`, and branches: - `201` -> freshly published - `409` -> already published at this version, skip - anything else -> real error, fail the step This keeps genuine failures (auth, 400, 5xx, transport) fatal while making release re-runs and tag-on-HEAD main pushes succeed idempotently. Branch logic validated against nu 0.112.2. Reference: https://forgejo.org/docs/latest/user/packages/generic/ (201 / 400 / 409 semantics). #VA-51

nrupard added 1 commit

2026-06-08 23:08:53 +02:00

fix(ci): make generic package upload idempotent on 409

Check / clippy + fmt + tests (pull_request) Successful in 1m35s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

6dbc7adb17

build-package.yml uploaded the agent binary and its checksum to the Forgejo generic registry with `curl --fail`, which turns the registry's 409 Conflict (duplicate file; the registry never overwrites) into exit 22 and fails the job. The collision is expected: get-version.nu collapses an exact `v*` tag (`vX.Y.Z-0-g<sha>`) to a bare `X.Y.Z`, so any push to main that lands on the tagged commit recomputes the same release version the tag-push run already published, and a plain workflow re-run does the same. Run #179 (ef8cad3, where v0.1.0 sits on main HEAD after the VA-49 retag) failed exactly this way.

A published release artifact is immutable, so re-uploading the same version must be a no-op rather than a hard failure. Drop `--fail`, capture the HTTP status with `--write-out`, and branch: 201 = freshly published, 409 = already published (skip), anything else = real error that fails the step. Validated the branch logic against nu 0.112.2.

#VA-51