bake-gem-github 0.0.3 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0643ea73beb64b3061e5ab768d1426e9220ec384ae07cb71c7e31239b671adf9
-  data.tar.gz: 05b9f8624c05fc27ec1197bd1097df44ec3ab2e0b802c9fbc94204e4bc73b8cf
+  metadata.gz: eb1ff7b71712625bd0f0732c6a945b72d555d7ccf0f318314500f61b626269aa
+  data.tar.gz: 627281b137b7161bd0f57d208f73cf8fa9e559cee46a63be7545c64e6a3ab24b
 SHA512:
-  metadata.gz: 1467cb16603f373a45d019f62010d0e49165a072a9cdf00cd64831404008a980343e388fd7b20d04cbe92d323ebdefdd3795ac63662e84d2b2569921285e76d8
-  data.tar.gz: 3114b8df86c511ee0a471f5482adf98bdc2769689ef6c94dcc6cf4611542935537217880bdea9f6adc73a7b65ef63f7c2682cac30ec2f9a7bd4d5a92029a200e
+  metadata.gz: 7e9e4d0798361689b919529a75415764c3d1d575737b5368a0bee445d406e399e8eba72a6eeee735bd01581912da8cb53496a48deff91d311b275cfe995590fa
+  data.tar.gz: ad0ade7c470f26b865b4dce5f7cee96af8f6042daf0ff35a5363a7393098ea414ee03233cfc92a70d1b622a7d83c57188e01aee3f6953d34af8b1fe903f5111d

data/context/getting-started.md

@@ -95,9 +95,11 @@ Use **Re-run all jobs** on the original publishing run, or:
 bundle exec bake gem:github:release:resume run=RUN_ID
 ```
 
-Rerunning keeps the original event identity. A retained artifact is downloaded and its source identity/digest checked. A matching registry version resumes tag/release finalization; different bytes or a conflicting tag stop. There is no automatic yank, retag, or rebuild of an already-published version. If failure occurs before artifact retention, rebuilding is safe because uploading has not started.
+Rerunning keeps the original event identity. A retained artifact is downloaded and its source identity/digest checked. A matching registry version resumes tag/release finalization; different bytes or a conflicting tag stop. There is no automatic yank, retag, or rebuild of an already-published version. Registry propagation is retried every ten seconds for up to one minute; a digest or attestation mismatch fails immediately.
 
-Artifacts are retained for 90 days and copied to GitHub release assets on success. If the workflow artifact expires before finalization, manual recovery from the preserved bytes is required; do not dispatch a replacement build. GitHub concurrency does not guarantee a durable FIFO queue: rerun any publishing run displaced while pending. Resume reruns all jobs, including integrity checks; it does not repeat or second-guess the native review policy or a permitted administrator bypass.
+Before uploading to RubyGems, the publisher stores the verified gem, receipt and both attestation bundles in a draft GitHub release targeting the merged commit. It publishes the draft after registry verification and tag creation. Actions artifacts are also retained for 90 days, but can disappear on rerun. Recovery falls back to the draft or published release and verifies the original bytes and attestations. Keep the draft until finalization succeeds. If asset preservation was interrupted and neither backup is complete, restore the missing original files before retrying; conflicting assets are never overwritten.
+
+GitHub concurrency does not guarantee a durable FIFO queue: rerun any publishing run displaced while pending. Resume reruns all jobs, including integrity checks; it does not repeat or second-guess the native review policy or a permitted administrator bypass. Older publishing runs execute their original code; adding this recovery support to the default branch does not change an already-triggered workflow.
 
 ## Development and current limits
 

data/lib/bake/gem/github/publisher.rb

@@ -13,6 +13,10 @@ module Bake
 		module GitHub
 			# Builds one artifact, preserves it before upload, and resumes without moving existing tags.
 			class Publisher < Project
+				# A registered package is not yet available from the download service.
+				class RegistryPending < RuntimeError
+				end
+				
 				# Build or restore this workflow run's artifact, after validating the actual merged commit.
 				def build(number)
 					guard_environment
@@ -23,24 +27,34 @@ module Bake
 					artifact = "release-#{evidence.fetch(:commit)}"
 					run = ENV.fetch("GITHUB_RUN_ID")
 					artifacts = api("actions/runs/#{run}/artifacts?per_page=100").fetch("artifacts")
-					if retained = artifacts.find{|entry| entry.fetch("name") == artifact}
-						raise "Retained artifact expired; restore it from the GitHub release before retrying." if retained.fetch("expired")
+					retained = artifacts.find{|entry| entry.fetch("name") == artifact}
+					if retained && !retained.fetch("expired")
 						system("gh", "run", "download", run, "--repo", @repository, "--name", artifact, "--dir", path, chdir: @root)
-						receipt = load_receipt
-						[:name, :version, :commit, :repository, :pull_request].each do |key|
-							raise "Retained artifact has different #{key}." unless receipt[key] == evidence[key]
+					elsif release = github_release("v#{evidence.fetch(:version)}")
+						guard_release(release, evidence.fetch(:commit))
+						filename = "#{evidence.fetch(:name)}-#{evidence.fetch(:version)}.gem"
+						files = release_files(file: filename)
+						names = release.fetch("assets").map{|asset| asset.fetch("name")}
+						raise "Retained release is incomplete; restore the original files before retrying." unless files.all?{|file| names.include?(File.basename(file))}
+						system("gh", "release", "download", release.fetch("tag_name"), "--repo", @repository, "--dir", path, *files.flat_map{|file| ["--pattern", File.basename(file)]}, chdir: @root)
+					elsif retained
+						raise "Retained artifact expired and no GitHub release is available. Restore the original files before retrying."
+					else
+						filename = "#{evidence.fetch(:name)}-#{evidence.fetch(:version)}.gem"
+						if registry_digest(evidence.fetch(:name), evidence.fetch(:version))
+							raise "Version is already published but this run has no retained artifact. Restore the original artifact; do not rebuild."
 						end
-						return output(receipt, restored: true)
+						package = build_package(path)
+						raise "Unexpected package filename." unless File.basename(package) == filename
+						receipt = evidence.merge(file: filename, sha256: Digest::SHA256.file(package).hexdigest, run_id: run, signing: @config.fetch("signing"))
+						File.write(File.join(path, "release.json"), JSON.pretty_generate(receipt) + "\n")
+						return output(receipt, restored: false)
 					end
-					filename = "#{evidence.fetch(:name)}-#{evidence.fetch(:version)}.gem"
-					if registry_digest(evidence.fetch(:name), evidence.fetch(:version))
-						raise "Version is already published but this run has no retained artifact. Restore the original artifact; do not rebuild."
+					receipt = load_receipt
+					[:name, :version, :commit, :repository, :pull_request].each do |key|
+						raise "Retained artifact has different #{key}." unless receipt[key] == evidence[key]
 					end
-					package = build_package(path)
-					raise "Unexpected package filename." unless File.basename(package) == filename
-					receipt = evidence.merge(file: filename, sha256: Digest::SHA256.file(package).hexdigest, run_id: run, signing: @config.fetch("signing"))
-					File.write(File.join(path, "release.json"), JSON.pretty_generate(receipt) + "\n")
-					output(receipt, restored: false)
+					output(receipt, restored: true)
 				end
 				
 				# Verify both attestations, upload exactly those bytes, then create only the intended tag and release.
@@ -65,37 +79,19 @@ module Bake
 					remote_digest = registry_digest(receipt.fetch(:name), receipt.fetch(:version))
 					if remote_digest
 						raise "Published version has different bytes." unless remote_digest == receipt.fetch(:sha256)
-					else
+					end
+					# Keep verified bytes independently of workflow attempts before uploading:
+					release = preserve_release(receipt)
+					unless remote_digest
 						gem_command("push", package, "--host", "https://rubygems.org", "--attestation", bundle)
 					end
-					# A failed read after upload is recoverable by rerunning the same workflow.
-					raise "Registry artifact does not match; retry after registry propagation." unless registry_digest(receipt.fetch(:name), receipt.fetch(:version)) == receipt.fetch(:sha256)
-					attestations = registry_get("https://rubygems.org/api/v1/attestations/#{receipt.fetch(:name)}-#{receipt.fetch(:version)}.json")
-					raise "Registry attestation is missing." unless attestations
-					registry_bundles = JSON.parse(attestations)
-					local_bundle = JSON.parse(File.read(bundle))
-					raise "Registry does not contain this artifact's Sigstore bundle." unless contains_bundle?(registry_bundles, local_bundle)
+					verify_registry(receipt, bundle)
 					unless readlines("git", "tag", "--list", tag, chdir: @root).any?
 						system("git", "tag", tag, receipt.fetch(:commit), chdir: @root)
 					end
 					system("git", "-c", "credential.helper=", "-c", "credential.helper=!gh auth git-credential", "push", "origin", "refs/tags/#{tag}", chdir: @root)
-					releases = JSON.parse(readlines("gh", "release", "list", "--repo", @repository, "--limit", "1000", "--json", "tagName", chdir: @root).join)
-					unless releases.any?{|entry| entry.fetch("tagName") == tag}
-						Tempfile.create("release-notes") do |file|
-							file.write("#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n")
-							file.flush
-							system("gh", "release", "create", tag, "--repo", @repository, "--verify-tag", "--title", "#{receipt.fetch(:name)} #{tag}", "--notes-file", file.path, chdir: @root)
-						end
-					end
-					# Existing immutable assets are checked before upload; never clobber them.
-					assets = api("releases/tags/#{tag}").fetch("assets")
-					[package, bundle, File.join(@root, "pkg", "release.json"), File.join(@root, "pkg", "provenance.sigstore.json")].each do |file|
-						if existing = assets.find{|asset| asset.fetch("name") == File.basename(file)}
-							digest = existing.fetch("digest")
-							raise "Existing release asset differs: #{file}" unless digest == "sha256:#{Digest::SHA256.file(file).hexdigest}"
-						else
-							system("gh", "release", "upload", tag, file, "--repo", @repository, chdir: @root)
-						end
+					if release.fetch("draft")
+						system("gh", "release", "edit", tag, "--repo", @repository, "--draft=false", "--verify-tag", chdir: @root)
 					end
 					receipt
 				end
@@ -120,6 +116,80 @@ module Bake
 				
 				private
 				
+				def github_release(tag)
+					pages = JSON.parse(readlines("gh", "api", "--paginate", "--slurp", "repos/#{@repository}/releases?per_page=100", chdir: @root).join)
+					matches = pages.flatten(1).select{|release| release.fetch("tag_name") == tag}
+					raise "Multiple GitHub releases have the same tag." if matches.size > 1
+					if release = matches.first
+						return api("releases/#{release.fetch('id')}")
+					end
+					# Resolve pending tags directly when the REST list has not caught up:
+					owner, name = @repository.split("/", 2)
+					query = "query($owner: String!, $name: String!, $tag: String!) { repository(owner: $owner, name: $name) { release(tagName: $tag) { databaseId } } }"
+					result = JSON.parse(readlines("gh", "api", "graphql", "-f", "query=#{query}", "-f", "owner=#{owner}", "-f", "name=#{name}", "-f", "tag=#{tag}", chdir: @root).join)
+					if release = result.fetch("data").fetch("repository").fetch("release")
+						api("releases/#{release.fetch('databaseId')}")
+					end
+				end
+				
+				def guard_release(release, commit)
+					if release.fetch("draft") && release.fetch("target_commitish") != commit
+						raise "Draft release targets another commit."
+					end
+				end
+				
+				def release_files(receipt)
+					[receipt.fetch(:file), "#{receipt.fetch(:file)}.sigstore.json", "release.json", "provenance.sigstore.json"].map{|name| File.join(@root, "pkg", name)}
+				end
+				
+				def preserve_release(receipt)
+					tag = "v#{receipt.fetch(:version)}"
+					release = github_release(tag)
+					unless release
+						Tempfile.create("release") do |file|
+							file.write(JSON.generate(
+								tag_name: tag, draft: true, target_commitish: receipt.fetch(:commit), name: "#{receipt.fetch(:name)} #{tag}",
+								body: "#{receipt.fetch(:pull_request_url)}\n\nSource: #{receipt.fetch(:commit)}\nSHA256: #{receipt.fetch(:sha256)}\n\nSee releases.md at the release tag for release notes.\n"
+							))
+							file.flush
+							# The release list can remain stale after a successful creation:
+							release = JSON.parse(readlines("gh", "api", "repos/#{@repository}/releases", "--method", "POST", "--input", file.path, chdir: @root).join)
+						end
+					end
+					guard_release(release, receipt.fetch(:commit))
+					assets = release.fetch("assets")
+					release_files(receipt).each do |file|
+						if existing = assets.find{|asset| asset.fetch("name") == File.basename(file)}
+							raise "Existing release asset differs: #{file}" unless existing.fetch("digest") == "sha256:#{Digest::SHA256.file(file).hexdigest}"
+						else
+							system("gh", "release", "upload", tag, file, "--repo", @repository, chdir: @root)
+						end
+					end
+					release
+				end
+				
+				def verify_registry(receipt, bundle, attempts: 7, delay: 10)
+					local_bundle = JSON.parse(File.read(bundle))
+					attempts.times do |attempt|
+						begin
+							if digest = registry_digest(receipt.fetch(:name), receipt.fetch(:version))
+								raise "Published version has different bytes." unless digest == receipt.fetch(:sha256)
+								if attestations = registry_get("https://rubygems.org/api/v1/attestations/#{receipt.fetch(:name)}-#{receipt.fetch(:version)}.json")
+									raise "Registry does not contain this artifact's Sigstore bundle." unless contains_bundle?(JSON.parse(attestations), local_bundle)
+									return
+								end
+							end
+						rescue RegistryPending
+							# The version API can become visible before the gem download:
+						end
+						if attempt < attempts - 1
+							Console.info(self, "Waiting for RubyGems to serve the release.")
+							sleep(delay)
+						end
+					end
+					raise "Registry propagation did not complete; rerun this workflow to resume from the retained release."
+				end
+				
 				def gem_command(*arguments)
 					if defined?(::Bundler)
 						::Bundler.with_unbundled_env{system("gem", *arguments, chdir: @root)}
@@ -193,7 +263,7 @@ module Bake
 					# Missing downloads can return 403; use the version API to establish absence.
 					return nil unless registry_get("https://rubygems.org/api/v2/rubygems/#{name}/versions/#{version}.json?platform=ruby")
 					body = registry_get("https://rubygems.org/downloads/#{name}-#{version}.gem")
-					raise "Published gem download is missing; retry after registry propagation." unless body
+					raise RegistryPending, "Published gem download is missing; retry after registry propagation." unless body
 					Digest::SHA256.hexdigest(body)
 				end
 				

data/lib/bake/gem/github/version.rb

@@ -9,7 +9,7 @@ module Bake
 	module Gem
 		# GitHub pull request and release orchestration for bake-gem.
 		module GitHub
-			VERSION = "0.0.3"
+			VERSION = "0.0.5"
 		end
 	end
 end

data/releases.md

@@ -1,5 +1,14 @@
 # Releases
 
+## v0.0.5
+
+  - Preserve and recover release files even when GitHub's release list is stale.
+
+## v0.0.4
+
+  - Preserve verified release files in a draft GitHub release before uploading to RubyGems, so reruns can recover when Actions artifacts disappear.
+  - Wait for RubyGems registry propagation before finalizing releases.
+
 ## v0.0.1
 
   - Initial implementation.

data/templates/releasing.md

@@ -6,7 +6,9 @@ Review the entire release diff. Native GitHub rules require the configured revie
 
 Merging a version increase publishes the actual merged commit through `release-publish.yaml`. There is no second release approval. The public `release.cert` stays in Git; the optional private key belongs in the Actions secret `GEM_SIGNING_KEY`, supplied by the `rubygems` environment or an organization secret. RubyGems authentication uses Trusted Publishing.
 
-If a publishing job fails, use **Re-run all jobs** on that same workflow run, or `bundle exec bake gem:github:release:resume run=RUN_ID`. The original artifact is downloaded before another upload is attempted. Do not create a replacement version bump or rebuild an already-published version. Conflicting bytes or tags require investigation; never automatically yank a version or move a tag.
+Before uploading to RubyGems, the publisher preserves the verified gem, receipt and both attestation bundles as assets of a draft GitHub release. The draft becomes public after registry verification and tag creation. Registry propagation is retried for up to one minute.
+
+If a publishing job fails, use **Re-run all jobs** on that same workflow run, or `bundle exec bake gem:github:release:resume run=RUN_ID`. The original artifact is restored from the workflow artifact or GitHub release before another upload is attempted. Actions artifacts can disappear on rerun, so the draft release is the durable backup. Do not delete it, create a replacement version bump or rebuild an already-published version. Conflicting bytes or tags require investigation; never automatically yank a version or move a tag. An incomplete draft requires restoring the missing original files before retrying.
 
 Verify both the downloaded gem and `release.json` with `gh attestation verify`, enforcing the publishing workflow's certificate identity and default branch ref. Then check the signed receipt's source commit and gem digest; follow the companion gem's setup guide for the complete commands. `--source-digest` checks the workflow revision, which can differ from the release commit. Release assets include the gem, RubyGems Sigstore bundle, GitHub provenance bundle, and signed source/digest receipt.
 

data.tar.gz.sig

@@ -1,2 +1,3 @@
-W������-j��7FN�+��M�z~�ty#@�I~�V��|��ȏF�4��|w-p�H8_���a����-D`ٿ\T۠�9�:����`ɂo�ՠ�0C���Kj����+����;2�e���j}����)�}��E��7�0���%�*
-Q� "�B��:z��{
���# �J�>>�l��T�p_�I/P�q��7z�����N�D<�-ﳢ\�����8o$�un�^|�(���t��_����g/��71i!��h�X���w2W�q�?}r�v	��Ѥ��̰c�L�2H6�H�Nfgx��b��9�՟�>�T�ڷb�=�T��m ��ݔe`N!���O�;�F���9j���ހ�k2�@87~9nHp�-M|�ӏ
+�ѓ@�I6����Es~���r?ŵ�����`�~�.NH�����PaZ��1����u*��n��U�zh5��U@3;F~83��e7߾~hC�ƴW���OA�m盓7K؎���D�e�l�|c�����������(%#	�;�.W>Ob�Y�������x$�*��tS�q��M�|�HAtPz�1K�"�4����g�j���Ѵ
+vV�`�]�Q�'��l;�x��g����J�� ���'-0��jH4��sEҏT�u�U뮜�:��X/�Nq�ȕ�~�b
+ƹBҵ Ӟ�$���

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem-github
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.5
 platform: ruby
 authors:
 - Samuel Williams

metadata.gz.sig

@@ -1,2 +1,2 @@
-kޘdYOEЂ�tF�6`�Mv�
��uEz,���tL�� {�`�}��o�-bU�$�E0*�4�r%vd��S�x�r���vl������	�V��p
ai��>_ӝ�	
-�m�*�
+���%ܗ��!8����D������D]L?
+V�t4?�ܮF��ԇƂQ��Q#��5�KOqRk3z��tޕ���?I�