From fcbc475fa8d157d8a091ec2630deda18fa1f1c14 Mon Sep 17 00:00:00 2001 From: antoinetoussaint-byte Date: Sun, 18 Oct 2026 01:15:04 -0400 Subject: [PATCH] fix: a reachability tag is not a published version; the two pseudo-versions released modules pinned from compat/v0.1.65 are retracted by name (#81) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The compat/v0.1.65 branch was replaced by the tag compat-v0.1.65-pins (annotations 0.2.15, robin 0.1.23 and record-store 0.2.2 pin two of its commits and must keep building). Go reads only vX.Y.Z tags as versions, so the published-tags gate now reads only those; what that tag keeps reachable is two pseudo-versions carrying the old Work Context implementation, outside the [v0.1.51, v0.1.65] retraction — retracted here by name. Co-authored-by: Antoine Toussaint Co-authored-by: Claude Opus 5.5 (cherry picked from commit e73dfc66597512a4a24ca4869ca7e14ae65e02dc) --- go.mod | 12 +++++++++++- go.sum | 2 ++ published_tags_test.go | 13 ++++++++++++- 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 1d9cffd..13457d4 100644 --- a/go.mod +++ b/go.mod @@ -7,6 +7,7 @@ require ( github.com/codefly-dev/core v0.19.1 github.com/jackc/pgx/v5 v5.10.0 github.com/stretchr/testify v1.12.1 + golang.org/x/mod v0.42.0 google.golang.org/grpc v1.84.0 google.golang.org/protobuf v1.36.12 ) @@ -103,4 +104,13 @@ require ( // retraction takes effect only once a NEW version is tagged carrying this // go.mod, and nothing here deletes anything from the proxy, because nothing // can. -retract [v0.1.51, v0.1.65] // a second Work Context implementation at the root +retract ( + v0.1.66-0.20260917202218-97dfea9e20d8 // a second Work Context implementation, pinned from compat/v0.1.65 + [v0.1.51, v0.1.65] // a second Work Context implementation at the root + // Two pseudo-versions released modules pinned from the compat/v0.1.65 branch + // (annotations 0.2.15, robin 0.1.23, record-store 0.2.2): they carry the same + // implementation and sort outside the range above (a prerelease of v0.1.51, and + // one of v0.1.66). The branch is gone; the tag compat-v0.1.65-pins keeps them + // reachable so those releases still build, retracted so nothing new picks them. + v0.1.51-0.20260927165945-8157d3abecb2 // a second Work Context implementation, pinned from compat/v0.1.65 +) diff --git a/go.sum b/go.sum index 29d57e6..85d8749 100644 --- a/go.sum +++ b/go.sum @@ -236,6 +236,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU= golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E= +golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg= +golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs= golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= diff --git a/published_tags_test.go b/published_tags_test.go index 1032da2..2c669e8 100644 --- a/published_tags_test.go +++ b/published_tags_test.go @@ -3,6 +3,7 @@ package codefly_test import ( "encoding/json" "fmt" + "golang.org/x/mod/semver" "os" "os/exec" "path/filepath" @@ -202,7 +203,11 @@ func localTags(t *testing.T) []string { require.NoError(t, err) var tags []string for _, line := range strings.Split(strings.TrimSpace(string(output)), "\n") { - if line != "" { + // A VERSION tag is a published version; any other tag is not one. Go reads only + // `vX.Y.Z` (and a module subdirectory prefix) as a version, so a reachability + // tag such as `compat-v0.1.65-pins` publishes no version of its own — what it + // keeps reachable is pseudo-versions, which go.mod retracts by name below. + if line != "" && semver.IsValid(strings.TrimPrefix(line, "workcontext/")) { tags = append(tags, line) } } @@ -244,6 +249,12 @@ func retractedVersions(t *testing.T, dir string) map[string]bool { covered := map[string]bool{} for _, tag := range localTags(t) { for _, span := range spans { + // A single retracted PSEUDO-version (a commit a release pinned, never a + // tag) cannot be any tag: tags are plain releases here, and the ordering + // below refuses a prerelease by design. It is what go.mod retracts by name. + if span.Low == span.High && semver.Prerelease(span.Low) != "" { + continue + } // `go mod edit -json` writes a single version as Low == High, so // one comparison covers both shapes. if semverAtMost(t, span.Low, tag) && semverAtMost(t, tag, span.High) {