From d3af13e11155518d4be4124c153026f203ffba88 Mon Sep 17 00:00:00 2001
From: Codex <codex@example.com>
Date: Thu, 24 Sep 2026 01:00:55 +0800
Subject: [PATCH] ci: refuse reused plugin versions and wait for deploy
 readiness

Downstream Release now fails before building when any bundled plugin keeps
the version it had in the previous codexrip release. Every release re-signs
the packages, and a reused immutable version left the plugin manager
degraded with every gateway request unavailable (v0.2.7-codexrip.3).

The production health step retries for up to three minutes instead of four
attempts in about six seconds, so a container still running migrations and
plugin bootstrap no longer marks a successful deploy as failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/downstream-release.yml | 25 ++++++++++++++++++++++++
 .github/workflows/production-deploy.yml  |  4 +++-
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/downstream-release.yml b/.github/workflows/downstream-release.yml
index b7ff720fe890..0de07f4736a3 100644
--- a/.github/workflows/downstream-release.yml
+++ b/.github/workflows/downstream-release.yml
@@ -66,6 +66,31 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
           echo "upstream_version=$upstream_version" >> "$GITHUB_OUTPUT"
           echo "build_date=$(git show -s --format=%cI "$source_sha")" >> "$GITHUB_OUTPUT"
+      # Every release re-signs the bundled packages. An installed immutable plugin
+      # version cannot take different bytes, so a reused version leaves the plugin
+      # manager degraded and every gateway request unavailable after deploy.
+      - name: Require new bundled plugin versions
+        shell: bash
+        run: |
+          set -euo pipefail
+          previous=$(git tag --merged HEAD --list 'v*.*.*-codexrip.*' --sort=-v:refname | grep -vxF "$RELEASE_TAG" | head -n1 || true)
+          if [[ -z "$previous" ]]; then
+            echo 'No earlier release tag on this history; nothing to compare.'
+            exit 0
+          fi
+          reused=()
+          for manifest in plugins/*/manifest.source.json; do
+            # A plugin added since the previous release has nothing to compare.
+            git cat-file -e "$previous:$manifest" 2>/dev/null || continue
+            current=$(jq -r .version "$manifest")
+            before=$(git show "$previous:$manifest" | jq -r .version)
+            [[ "$current" != "$before" ]] || reused+=("$(basename "$(dirname "$manifest")")@$current")
+          done
+          if ((${#reused[@]})); then
+            echo "::error::Bundled plugin versions unchanged since $previous: ${reused[*]}. Bump every bundled plugin before tagging."
+            exit 1
+          fi
+          echo "Bundled plugin versions all differ from $previous."
       # Required PR checks admit code to main. Reuse that validation here;
       # publishing verifies immutable source metadata and builds the artifact,
       # rather than rerunning source, frontend, race or migration test suites.
diff --git a/.github/workflows/production-deploy.yml b/.github/workflows/production-deploy.yml
index 0fa0110a0f94..fed1f3a522f7 100644
--- a/.github/workflows/production-deploy.yml
+++ b/.github/workflows/production-deploy.yml
@@ -353,8 +353,10 @@ jobs:
             -p "$VPS_PORT" \
             "${VPS_USER}@${VPS_HOST}" \
             "$remote_command"
+      # The recreated container needs time for migrations and plugin bootstrap; the
+      # edge answers 502/503 until then, so keep retrying for up to three minutes.
       - name: Verify public health
         env:
           PUBLIC_HEALTH_URL: ${{ secrets.PUBLIC_HEALTH_URL }}
         shell: bash
-        run: curl --fail --silent --show-error --retry 3 --retry-delay 2 --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null
+        run: curl --fail --silent --show-error --retry 36 --retry-delay 5 --retry-max-time 180 --retry-connrefused --max-time 30 "$PUBLIC_HEALTH_URL" >/dev/null