Repository navigation
Inspect stranded GitHub releases before granting publication authority #598
Description
🤖 Generated by the Agentic Engineer
Problem
Two Platform releases have tags but no GitHub release records (#587). Recovery needs trustworthy evidence of the original failed run, exact source, supported publisher configuration and current partial effects before any publication authority is obtained. Today this requires manual investigation and a successful normal release run can conceal the gap.
Proposed outcome
Deliver a reusable, explicitly enabled read-only inspection path in the maintained catalogue. It produces a bounded machine-readable diagnosis for one existing stable tag, with its original failed run and source. It performs no publication and grants no write permissions. This is the first delivery child of #587; publication, channel-note repair, legacy compatibility and protected consumer recovery remain on that parent.
Acceptance criteria
- Validate repository, stable tag, full source SHA, original run ID/attempt and immutable original release-workflow identity before making API requests.
- Read the exact failed push/default-branch run attempt, tag/source, strict supported GitHub-only JSON configuration and publication state. Refuse mismatches, unsupported publishers, incomplete or failed reads, redirects and conflicting publication identities.
- Emit a machine-readable missing-publication or already-published diagnosis only after independently repeating the relevant reads. Do not describe a plan as publication success or future authorization.
- Make only bounded GET requests using a repository-scoped read-only token; load the inspector from the reusable workflow's immutable catalogue revision. Preserve all normal release behavior and permission compatibility.
- Exercise the actual inspector with native HTTP controls for partial, complete, changed, malformed and unavailable evidence; verify only GET requests and no partial success output.
- Verify the shipped read-only path against the real public incident identities, while leaving both missing releases and Recover GitHub releases after a tag-only partial publication #587 open until separately recovered.
Priority: High, inherited from the recurring release incident. Effort: Medium. Service class: Risk reduction. Success is an evidenced diagnosis without any remote mutation; zero unauthorized writes is the guardrail. This bounded delivery has no prerequisite beyond #587's already completed refinement. The maintainer explicitly waived WIP limits for this round.
Part of #587.
Metadata
Metadata
Assignees
Labels
Type
Fields
Priority
Start date
Target date
Effort
Projects
- Status
Activity
chore: agent-claim #598 nonce=305a9f6198e02a69aaeda5e6540c5495
devantler commentedon Oct 15, 2026
Delivered in #599, merged as
226e6e7e5f3609868eb96a6a26f6dc293c88ba30, and published as v7.11.0. The fetched version tag resolves to that exact merge. Its complete tree equals reviewed source0247eeac41fe236d9745fc97a6815393f5cf0c4c.The exact-head native CI succeeded with all 249 jobs settled and no failed or pending job. Fresh Codex review reports a clean result at that source; all five review threads are resolved and the body findings have specific fixes or assessments. Readable required gates passed, and the normal protected merge API accepted the expected head. The configured code-quality rule had no independently readable verdict; no bypass or protection change was used.
The actual default-branch workflow was then evaluated at the merged revision, with run/attempt, source, job and emitted diagnosis read back:
v1.222.1incidentv1.223.3incidentBoth enabled receipts bind the exact original failed run/attempt, tag, source and producer. They explicitly return
authorization: none,publication_success: false,publication_scope: published-release-by-tag, and uninspected draft/channel metadata. The native implementation repeats the evidence reads before emitting that result. Earlier local HTTP/race/vet controls cover malformed, changed, unavailable and conflicting evidence, including both documented workflow-ref representations.This completes this child's acceptance. Neither Platform release was recovered. Publication, any necessary channel metadata, legacy delivery and protected consumer recovery stay open in #587. The separate channel-note diagnostic on that parent supports reducing the future write scope; it is not publication proof.