fix(release): classify App-token 404s when creating nightly tags - #128
Merged
Conversation
The nightly publish step treated header-less gh 404s and an uncaptured post-create peel as hard failures after the tag POST, so the receipt was never retained. Classify 404s from either HTTP status lines or gh's error text, retry the peel, and cover the path with a harness.
jatmn
marked this pull request as ready for review
September 13, 2026 16:13
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. If the helper is wrong, it could create a nightly tag pointing at an unintended commit, and that tag remains after reverting the change. The tag can generally be removed and recreated, so the damage is bounded, but downstream consumers may observe the incorrect tag before repair.
jatmn
pushed a commit
that referenced
this pull request
Sep 13, 2026
🤖 I have created a release *beep* *boop* --- ## [0.1.1](v0.1.0...v0.1.1) (2026-09-13) ### Bug Fixes * **continue_guard:** keep long multi-agent sessions auto-continuing ([#118](#118)) ([1a39847](1a39847)) * **models:** honor WebUI disable for colliding cross-provider slugs ([#117](#117)) ([7f149d4](7f149d4)) * **provider:** identify OpenCode Go sessions ([#121](#121)) ([d81deaa](d81deaa)) * **release:** classify App-token 404s when creating nightly tags ([#128](#128)) ([478d974](478d974)) * **release:** include maintenance notes without triggering releases ([#125](#125)) ([e837600](e837600)) * **security:** confine docs checker path.resolve to the repo base ([#120](#120)) ([12de5b1](12de5b1)) * **security:** harden documentation path confinement ([#115](#115)) ([26431ce](26431ce)) ### Documentation * document live releases and commit title templates ([#114](#114)) ([9a0794c](9a0794c)) ### Build System * **deps:** Bump crate-ci/typos from 1.49.0 to 1.50.1 ([#124](#124)) ([fdef744](fdef744)) * **deps:** Bump reqwest from 0.13.4 to 0.13.5 ([#126](#126)) ([1ca3cdb](1ca3cdb)) * **deps:** Bump taiki-e/install-action from 2.86.8 to 2.87.4 ([#123](#123)) ([010133c](010133c)) * **deps:** Bump taiki-e/install-action from 2.87.4 to 2.87.9 ([#127](#127)) ([653a113](653a113)) * **deps:** Bump toml from 1.1.4+spec-1.1.0 to 1.1.5+spec-1.1.0 ([#122](#122)) ([f539391](f539391)) ### Continuous Integration * stop scanners treating the GitHub App action pin as a secret ([#119](#119)) ([783bbda](783bbda)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: codex-warp-release-bot[bot] <323806225+codex-warp-release-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Create immutable nightly tag and receiptwithgh: Not Found (HTTP 404)after GitHub CLI 2.100.0 omitted anHTTP/2.0 404status line. The tag POST had already succeeded, sonightly-20260913-653a113ca227exists at653a113ca22799837c4fe6739903b72850e0cbb5with no receipt and no release.scripts/create-nightly-tag.sh, which classifies 404s from--includestatus lines orgh: Not Found (HTTP NNN), captures POST, retries the post-create peel, then writesnightly-tag-receipt.json. Existing-tag and 422 paths stay fail-closed.recover-orphan-tagstill requires a successful tag step plusnightly-tag-creation-receipt; clearingnightly-20260913-653a113ca227remains documented maintainer break-glass.Reviewed SHA:
778a1973149ae74c69603708d1221f499f63cbafContribution checklist
Validation
bash scripts/ci-preflight.sh(use--base origin/<base-branch>for a non-mainbase)bash scripts/install-git-hooks.shFocused:
bash scripts/create-nightly-tag-harness.shandbash scripts/source-checks.shpassed on this SHA. Pre-push re-ranbash scripts/ci-preflight.shon the same tree.Maintainer checklist
Summary by Sourcery
Harden nightly tag creation so successful tag posts remain recoverable when GitHub CLI omits HTTP status headers, while only issuing receipts after the tag is verified.
Bug Fixes:
Enhancements:
Tests: