release/0.4: backport #81, restoring the retractions v0.4.2 lost

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/codefly-dev/core v0.19.1
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/stretchr/testify v1.12.1
+	golang.org/x/mod v0.42.0
 	google.golang.org/grpc v1.84.0
 	google.golang.org/protobuf v1.36.12
 )
@@ -103,4 +104,13 @@ require (
 // retraction takes effect only once a NEW version is tagged carrying this
 // go.mod, and nothing here deletes anything from the proxy, because nothing
 // can.
-retract [v0.1.51, v0.1.65] // a second Work Context implementation at the root
+retract (
+	v0.1.66-0.20260917202218-97dfea9e20d8 // a second Work Context implementation, pinned from compat/v0.1.65
+	[v0.1.51, v0.1.65] // a second Work Context implementation at the root
+	// Two pseudo-versions released modules pinned from the compat/v0.1.65 branch
+	// (annotations 0.2.15, robin 0.1.23, record-store 0.2.2): they carry the same
+	// implementation and sort outside the range above (a prerelease of v0.1.51, and
+	// one of v0.1.66). The branch is gone; the tag compat-v0.1.65-pins keeps them
+	// reachable so those releases still build, retracted so nothing new picks them.
+	v0.1.51-0.20260927165945-8157d3abecb2 // a second Work Context implementation, pinned from compat/v0.1.65
+)

go.sum

@@ -236,6 +236,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba h1:Ck8QetSgk912qxWLMCKxd0in+aiyBQyDSMae6e/xmpU=
 golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba/go.mod h1:50RgIsmK7OwqzTTeqcSXQW8SswW0o8fRcDxmqGluJ8E=
+golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg=
+golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs=
 golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
 golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=

published_tags_test.go

@@ -3,6 +3,7 @@ package codefly_test
 import (
 	"encoding/json"
 	"fmt"
+	"golang.org/x/mod/semver"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -202,7 +203,11 @@ func localTags(t *testing.T) []string {
 	require.NoError(t, err)
 	var tags []string
 	for _, line := range strings.Split(strings.TrimSpace(string(output)), "\n") {
-		if line != "" {
+		// A VERSION tag is a published version; any other tag is not one. Go reads only
+		// `vX.Y.Z` (and a module subdirectory prefix) as a version, so a reachability
+		// tag such as `compat-v0.1.65-pins` publishes no version of its own — what it
+		// keeps reachable is pseudo-versions, which go.mod retracts by name below.
+		if line != "" && semver.IsValid(strings.TrimPrefix(line, "workcontext/")) {
 			tags = append(tags, line)
 		}
 	}
@@ -244,6 +249,12 @@ func retractedVersions(t *testing.T, dir string) map[string]bool {
 	covered := map[string]bool{}
 	for _, tag := range localTags(t) {
 		for _, span := range spans {
+			// A single retracted PSEUDO-version (a commit a release pinned, never a
+			// tag) cannot be any tag: tags are plain releases here, and the ordering
+			// below refuses a prerelease by design. It is what go.mod retracts by name.
+			if span.Low == span.High && semver.Prerelease(span.Low) != "" {
+				continue
+			}
 			// `go mod edit -json` writes a single version as Low == High, so
 			// one comparison covers both shapes.
 			if semverAtMost(t, span.Low, tag) && semverAtMost(t, tag, span.High) {