fix: decouple NuGet publication from indexing latency by rodri-oliveira-dev · Pull Request #181 · rodri-oliveira-dev/Dapper-FluentMap

rodri-oliveira-dev · 2026-09-09T19:30:53Z

Summary

Keeps the core fix from PR #181: NuGet.org indexing is asynchronous, so a successful dotnet nuget push no longer blocks publication of the remaining governed package set while waiting for Flat Container visibility.

This update also improves the manual recovery UX by resolving the release source up front from a static workflow_dispatch input model:

Branch mode: source_type=branch, source_ref=master, version=3.1.2. The workflow resolves refs/heads/master, the current remote branch HEAD commit, and the explicit version.
Tag mode: source_type=tag, source_ref=v3.1.2, version empty. The workflow validates the remote tag, derives version 3.1.2, and peels v3.1.2^{commit} so lightweight and annotated tags both resolve to the validated commit.

validated_commit is no longer an operator-facing input; recovery derives it internally from the selected branch or tag and logs an early source-resolution summary.

Changes

normal release and recovery now share the explicit release concurrency group with cancel-in-progress: false, so governed release/package state cannot be mutated concurrently and recovery never cancels a running release;
NuGet.org publication keeps package submission non-blocking per identity, distinguishes push failure from accepted-but-not-indexed packages, and reports precise convergence timeouts;
symbol-enabled packages are handled independently: primary .nupkg publication uses --no-symbols, then .snupkg artifacts are submitted separately through NuGet.org V3 tooling;
recovery now reconciles the governed release state, not only NuGet.org: NuGet.org, GitHub Packages, tag, GitHub Release, artifacts, checksums, and attestations;
recovery resolves the selected branch/tag source once, then uses normalized version, commit, release tag, and release-history ref throughout the pipeline;
recovery prefers the original release-package artifact from an explicit original_release_run_id, validates SHA256SUMS/manifest/catalog/version/repository/commit against the resolved source, and falls back to a deterministic rebuild when that artifact is unavailable;
recovery refuses to overwrite packages, move an existing tag, accept mismatched NuGet.org primary package content, or report success before final reconciliation;
CI now runs release-governance tests with mocked git/curl/dotnet, so no real NuGet.org publication is triggered.

Operator note

For branch recovery, use:

source_type = branch
source_ref = master
version = 3.1.2

For tag recovery, use:

source_type = tag
source_ref = v3.1.2
version = empty

Tag mode automatically derives the package version and validated commit. Providing a non-empty version in tag mode fails closed to avoid ambiguous operator intent.

When possible, provide original_release_run_id from the failed normal release run so recovery can reuse the exact validated release-package artifact. If that artifact has expired or is unavailable, the workflow logs the deterministic rebuild fallback and validates the rebuilt artifact set before any publication.

Symbol package limitation

NuGet.org documents .snupkg validation/indexing as asynchronous and supports publishing symbols through the V3 API, but it does not expose a public Flat Container-style endpoint that lets this workflow download and byte-compare an existing .snupkg. Recovery therefore submits symbol packages separately and logs that limitation instead of claiming independent symbol-byte verification. Primary .nupkg artifacts remain content-verified.

Validation

powershell -NoProfile -ExecutionPolicy Bypass -File ./eng/test-release-governance.ps1;
python -m check_jsonschema --builtin-schema vendor.github-workflows .github/workflows/*.yml;
git diff --check;
dotnet restore ./Dapper.FluentMap.slnx;
dotnet build ./Dapper.FluentMap.slnx --configuration Release --no-restore;
dotnet test ./Dapper.FluentMap.slnx --configuration Release --no-build;
dotnet pack ./Dapper.FluentMap.slnx --configuration Release --no-build --output ./artifacts/validation-packages-20260909204859;
powershell -NoProfile -ExecutionPolicy Bypass -File ./eng/validate-package-metadata.ps1 -PackageDirectory ./artifacts/validation-packages-20260909204859;
powershell -NoProfile -ExecutionPolicy Bypass -File ./eng/validate-release-artifacts.ps1 -PackageDirectory ./artifacts/validation-packages-20260909204859 -Version 3.0.1-dev ....

pwsh and actionlint were not available on the local machine; Windows PowerShell and GitHub workflow schema validation passed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 055bc013d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-09-09T19:34:31Z

SonarQube Cloud success

The SonarQube Cloud Quality Gate passed for this PR.

Quality Gate status: OK

Metric	Status	Actual	Threshold
`new_reliability_rating`	OK	`1`	`1`
`new_security_rating`	OK	`1`	`1`
`new_maintainability_rating`	OK	`1`	`1`
`new_duplicated_lines_density`	OK	`0.0`	`3`
`new_security_hotspots_reviewed`	OK	`100.0`	`100`

rodri-oliveira-dev · 2026-09-09T20:09:49Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9725748dbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

rodri-oliveira-dev · 2026-09-09T23:59:03Z

@codex review

chatgpt-codex-connector · 2026-09-09T23:59:11Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

rodri-oliveira-dev · 2026-09-10T00:02:59Z

@codex review

chatgpt-codex-connector · 2026-09-10T00:03:09Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

rodri-oliveira-dev · 2026-09-10T08:03:17Z

@codex revirew

chatgpt-codex-connector · 2026-09-10T08:03:29Z

To use Codex here, create an environment for this repo.

rodri-oliveira-dev · 2026-09-10T08:18:10Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 133d0dfa47

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

rodri-oliveira-dev · 2026-09-10T09:56:14Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1976fa76dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

fix: decouple NuGet publishing from indexing latency

055bc01

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread eng/publish-package-set.ps1 Outdated

rodri-oliveira-dev added 2 commits September 9, 2026 16:35

ci: wait for NuGet indexing during recovery

5571d34

fix: make partial NuGet recovery resumable

9725748

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/release-recovery-missing-nuget.yml

Comment thread .github/workflows/release-recovery-missing-nuget.yml Outdated

rodri-oliveira-dev added 5 commits September 9, 2026 17:35

fix: require partial release proof in NuGet recovery

785ad88

fix: harden async NuGet release recovery

b527588

test: make release governance diagnostics portable

2fc5ec7

ci: add release recovery source resolution

7f566df

test: make release source diagnostics portable

133d0df

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread .github/workflows/release-recovery-missing-nuget.yml

Comment thread .github/workflows/release-recovery-missing-nuget.yml

ci: harden release recovery reconciliation

1976fa7

chatgpt-codex-connector Bot reviewed Sep 10, 2026

View reviewed changes

Comment thread .github/workflows/release-recovery-missing-nuget.yml

Comment thread .github/workflows/release-recovery-missing-nuget.yml

Comment thread .github/workflows/release-recovery-missing-nuget.yml

ci: verify recovered release state

fc206ba

rodri-oliveira-dev merged commit b510cd9 into master Sep 10, 2026
6 checks passed

rodri-oliveira-dev deleted the fix/nuget-async-indexing branch September 10, 2026 11:06

Uh oh!

Conversation

rodri-oliveira-dev commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Operator note

Symbol package limitation

Validation

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

github-actions Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SonarQube Cloud success

Uh oh!

rodri-oliveira-dev commented Sep 9, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

rodri-oliveira-dev commented Sep 9, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 9, 2026

Uh oh!

rodri-oliveira-dev commented Sep 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 10, 2026

Uh oh!

rodri-oliveira-dev commented Sep 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 10, 2026

Uh oh!

rodri-oliveira-dev commented Sep 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

rodri-oliveira-dev commented Sep 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rodri-oliveira-dev commented Sep 9, 2026 •

edited

Loading

github-actions Bot commented Sep 9, 2026 •

edited

Loading