CLI release-plan recovery cannot create a previously absent exact tag with its GitHub Actions token.

Author: durable-workflow-ops

scripts/ci/cli-release-plan-recovery.fixture.yml

@@ -84,12 +84,17 @@ jobs:
       - name: Require repository publication credential
         env:
           CLI_RELEASE_DEPLOY_KEY: ${{ secrets.CLI_RELEASE_DEPLOY_KEY }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           if [ -z "$CLI_RELEASE_DEPLOY_KEY" ]; then
             printf 'The release-plan-publication environment has no repository write deploy key.\n' >&2
             exit 1
           fi
+          if [ -z "$GH_TOKEN" ]; then
+            printf 'The protected publication job has no GitHub Actions credential.\n' >&2
+            exit 1
+          fi
 
       - uses: actions/checkout@v6
         with:
@@ -120,6 +125,55 @@ jobs:
           RELEASE_COMMIT: ${{ needs.discover.outputs.commit }}
         run: scripts/ci/verify-release-tag-source.sh
 
+      - name: Quarantine the exact tag-triggered publication run
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.discover.outputs.version }}
+          RELEASE_COMMIT: ${{ needs.discover.outputs.commit }}
+        run: |
+          set -euo pipefail
+          cancel_requested=false
+          quarantined=false
+          retained_run_id=
+          for attempt in {1..12}; do
+            gh run list --workflow release.yml --event push --branch "$RELEASE_TAG" --limit 100 \
+              --json databaseId,event,displayTitle,headBranch,headSha,status,conclusion,url,workflowName \
+              > tag-push-runs.json
+            decision="$(python scripts/ci/component-release-recovery.py select-tag-push-run \
+              --release-tag "$RELEASE_TAG" --release-commit "$RELEASE_COMMIT" \
+              --runs tag-push-runs.json)"
+            IFS=$'\t' read -r quarantine_action run_id status conclusion <<< "$decision"
+            if [ -n "$run_id" ]; then
+              if [ -n "$retained_run_id" ] && [ "$retained_run_id" != "$run_id" ]; then
+                printf 'Tag-push quarantine changed from run %s to run %s.\n' \
+                  "$retained_run_id" "$run_id" >&2
+                exit 1
+              fi
+              retained_run_id="$run_id"
+            fi
+            if [ "$quarantine_action" = cancel ] && [ "$cancel_requested" != true ]; then
+              gh run cancel "$run_id"
+              cancel_requested=true
+            elif [ "$quarantine_action" = complete ]; then
+              quarantined=true
+              break
+            fi
+            [ "$attempt" -eq 12 ] || sleep 5
+          done
+          if [ "$quarantined" != true ] || [ -z "$retained_run_id" ]; then
+            printf 'The exact tag-push publication run was not observed and cancelled.\n' >&2
+            exit 1
+          fi
+          gh run view "$retained_run_id" \
+            --json databaseId,event,displayTitle,headBranch,headSha,status,conclusion,url,workflowName \
+            > tag-push-run.json
+          python scripts/ci/component-release-recovery.py retain-tag-push-run \
+            --repository "$GITHUB_REPOSITORY" \
+            --release-tag "$RELEASE_TAG" --release-commit "$RELEASE_COMMIT" \
+            --run-id "$retained_run_id" --run tag-push-run.json \
+            --evidence release-tag-push-quarantine-evidence.json
+
+
       - name: Start or resume the exact repository-owned publication run
         env:
           GH_TOKEN: ${{ github.token }}
@@ -218,25 +272,55 @@ jobs:
           fi
           retain_publication_run success
 
-      - name: Verify installable public CLI artifacts
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          python scripts/ci/component-release-recovery.py verify \
-            --component cli --plan recovery-input/release-plan.json \
-            --attempts 6 --sleep 10 --evidence release-completion-evidence.json
-
       - name: Retain publication evidence
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: cli-release-publication-${{ needs.discover.outputs.plan }}
           path: |
             release-tag-publication-evidence.json
+            tag-push-runs.json
+            tag-push-run.json
+            release-tag-push-quarantine-evidence.json
             publication-runs.json
             publication-dispatch-request.json
             publication-dispatch.json
             publication-run.json
             release-publication-run-evidence.json
-            release-completion-evidence.json
+          if-no-files-found: warn
+
+  verify-publication:
+    name: Verify installable public CLI artifacts
+    needs: [discover, publish]
+    if: needs.discover.outputs.action == 'publish' && needs.publish.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      attestations: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Restore the immutable release plan
+        uses: actions/download-artifact@v8
+        with:
+          name: cli-release-recovery-${{ needs.discover.outputs.plan }}
+          path: recovery-input
+
+      - name: Verify installable public CLI artifacts
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          python scripts/ci/component-release-recovery.py verify \
+            --component cli --plan recovery-input/release-plan.json \
+            --attempts 6 --sleep 10 --evidence release-completion-evidence.json
+
+      - name: Retain installability evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: cli-release-verification-${{ needs.discover.outputs.plan }}
+          path: release-completion-evidence.json
           if-no-files-found: warn

scripts/ci/component-release-recovery.py

@@ -59,7 +59,7 @@
 # SHA-256 of durable-workflow/cli's protected release recovery workflow.
 # Exact source identity is required because source-pattern matching cannot
 # prove that tag creation remains inside the protected repository authority.
-CLI_RELEASE_RECOVERY_SHA256 = "b4636ab25c27c07a3f4c1b95313abf3377447e82a9dc7632c1aa48abc3d5a97c"
+CLI_RELEASE_RECOVERY_SHA256 = "7ae7a13a8a292569d88ff33d79abdc70bccf666ff359d8da8cb1b62585efacfc"
 
 # SHA-256 of durable-workflow/sdk-rust's prepared-plan recovery workflow. The
 # verifier normalizes only