fix(ci): fail fast and legibly when the push cannot succeed #2

Merged

oap merged 1 commit from fix/publish-diagnostics into main

2026-09-07 22:43:20 -07:00

oap commented

2026-09-07 22:42:47 -07:00

Owner

Follow-up to the first real run of publish.yaml, which failed with:

could not pin kvartsi at <sha> after 5 attempts

That message points at the race-retry loop. The actual cause was that KVARTSI_TOKEN was empty — nas provisions it via forgejo-actions-secrets, and that host has not been deployed yet. Anyone reading the log would have gone looking at concurrency.

Only retry what retrying can fix

The loop treated every push failure as a lost race. A bad credential, a protected branch or a deleted repo fails identically five times and then reports the attempt count instead of the error.

Now only a non-fast-forward retries; everything else fails immediately and prints git's own output. Verified by classifying real captured output from both cases — a genuine ! [rejected] ... (non-fast-forward) and the actual Authentication failed this run produced.

Check the token up front

kvartsi is public, so git clone succeeds with no credential at all — the missing secret only surfaces four steps later, at the push, as an auth error against a URL that looks correct. A one-line check names the problem and the host that fixes it.

No behaviour change on the happy path.

Follow-up to the first real run of `publish.yaml`, which failed with: ``` could not pin kvartsi at <sha> after 5 attempts ``` That message points at the race-retry loop. The actual cause was that `KVARTSI_TOKEN` was empty — nas provisions it via `forgejo-actions-secrets`, and that host has not been deployed yet. Anyone reading the log would have gone looking at concurrency. ### Only retry what retrying can fix The loop treated every push failure as a lost race. A bad credential, a protected branch or a deleted repo fails identically five times and then reports the attempt count instead of the error. Now only a non-fast-forward retries; everything else fails immediately and prints git's own output. Verified by classifying real captured output from both cases — a genuine `! [rejected] ... (non-fast-forward)` and the actual `Authentication failed` this run produced. ### Check the token up front kvartsi is public, so `git clone` succeeds with **no credential at all** — the missing secret only surfaces four steps later, at the push, as an auth error against a URL that looks correct. A one-line check names the problem and the host that fixes it. No behaviour change on the happy path.

oap added 1 commit

2026-09-07 22:42:47 -07:00

fix(ci): fail fast and legibly when the push cannot succeed

publish / bump (push) Successful in -5s

Details

246d1c8137

The first real run failed and said "could not pin kvartsi at <sha> after 5
attempts", which points at the race-retry loop. The actual cause was that
KVARTSI_TOKEN was empty, because the nas host that provisions it had not been
deployed yet. Anyone reading that message would go looking at concurrency.

Two things were wrong.

The retry did not distinguish a lost race from a permanent failure. A bad
credential, a protected branch or a deleted repo fails identically five times
and then reports the retry count instead of the error. Now only a
non-fast-forward retries — verified by classifying git's real output for both
cases — and everything else fails immediately and prints what git said.

And an empty token was invisible until the push. kvartsi is a public repo, so
the clone succeeds with no credential at all; only the push is refused, four
steps later, as an authentication error against a URL that looks fine. Checking
the token up front costs nothing and names the host that provisions it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

oap merged commit 246d1c8137 into main

2026-09-07 22:43:20 -07:00

oap deleted branch fix/publish-diagnostics

2026-09-07 22:43:20 -07:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

oap/kartuli-ena!2

No description provided.

Rows
Columns