Repository navigation
fix: revalidate registry catalogs during release readback - #991
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release readback could keep seeing an old gallery entry after the exact new package had been published. Open VSX returned only 0.1.0 for the default query while the same query with
Cache-Control: no-cachereturned the newly published 0.1.4. Request revalidation and record that request policy in the receipt.The exact version, prerelease, trusted-publishing metadata and downloaded payload checks are unchanged. Two captured public responses cover stale-entry refusal and fresh-entry acceptance; the actual network regression passed with all 440 released package files matching and
publishedWithTrustedPublishing=true. The captured-fixture test covers parsing, while the paired live requests establish the transport behavior.Validation: 68 Python tests pass with ResourceWarnings treated as errors, Ruff and
git diff --checkpass, and an independent reviewer reran the suite. No version bump, package rebuild, tag change, credential or access change. The original failed CI readback is retained; a read-only CI audit of the existing 0.1.4 release will verify the merged fix.