publish_bundle: refresh remote ref before --force-with-lease push #6

Merged

anaeem merged 1 commit from apme/fix-publish-bundle-push into main

2026-05-22 20:10:17 +00:00

anaeem commented

2026-05-22 20:09:59 +00:00

Owner

Root cause reproduced locally: --force-with-lease rejects with ! [rejected] (stale info) when the local clone's refs/remotes/origin/bundle/<slug> is older than what the remote currently has.

Fix: re-fetch the branch ref immediately before push, then use the explicit --force-with-lease=<ref>:<sha> form. Race protection preserved (if remote advances between fetch and push, lease still rejects). Fallback to plain push for the first-run case (remote branch doesn't exist yet).

Also adds failed_when: rc != 0 so non-zero exits abort the per-app job rather than continuing silently, and an echo task so the push rc shows in the log without leaking the PAT-bearing URL.

Fixes the silent failure surfaced during AAP testing of PR #4: per-app job 21637 ran the full v4 pipeline successfully through render+containerfile+validate, then failed at publish_bundle git push with `no_log: true` masking the real error. Root cause reproduced locally: `--force-with-lease` rejects with `! [rejected] (stale info)` when the local clone's `refs/remotes/origin/bundle/<slug>` is older than what the remote currently has. Fix: re-fetch the branch ref immediately before push, then use the explicit `--force-with-lease=<ref>:<sha>` form. Race protection preserved (if remote advances between fetch and push, lease still rejects). Fallback to plain push for the first-run case (remote branch doesn't exist yet). Also adds `failed_when: rc != 0` so non-zero exits abort the per-app job rather than continuing silently, and an echo task so the push rc shows in the log without leaking the PAT-bearing URL.

anaeem added 1 commit

2026-05-22 20:09:59 +00:00

publish_bundle: refresh remote ref before --force-with-lease push

APME static analysis / apme-check (pull_request) Has been cancelled

Details

432a3cfc47

`--force-with-lease` rejects with "stale info" when local's view of
`refs/remotes/origin/bundle/<slug>` is older than the actual remote.
That happens any time the remote branch advanced after our initial
fetch (concurrent re-runs, /revalidate flow, engineer edit). Surfaced
during AAP testing: job 21637 (per-app with `publish_bundle_gitea_pat`)
failed at the push step with no_log:true censoring the error message.

The fix:
1. `git fetch origin "bundle/<slug>" --depth 1` immediately before
   the push to refresh local's view of the remote.
2. `git rev-parse origin/bundle/<slug>` to read the refreshed sha.
3. `--force-with-lease=bundle/<slug>:$REMOTE_SHA` — the explicit-ref
   form. If the remote advances BETWEEN our fetch and our push, the
   lease still rejects (race protection preserved). If our local ref
   matches the remote, the push succeeds.
4. Fallback to a plain push (no --force) when the remote branch
   doesn't exist yet (first-run case).
5. Added a second debug task to echo the push rc so failures aren't
   silent — the no_log:true on the push itself stays (the PAT is
   embedded in the remote URL).
6. failed_when: _pb_push.rc != 0 to make sure non-zero exits abort
   the per-app job rather than continuing silently.

Reproduced + verified locally on /tmp/publish-bundle-repro and
/tmp/pb-repro-v3 with two cycles of fresh-clone-then-push.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>