Reconcile stale release surfaces after v0.2.1 #664

New issue

Closed

opened 2026-05-09 00:46:57 +00:00 by barrettruth · 2 comments

barrettruth commented

2026-05-09 00:46:57 +00:00

Owner

Problem

The corrected zerover release surface is reconciled enough for users: LuaRocks still has a historical 0.3.0-1 row, but the artifact has been force-replaced with a tombstone source rock that fails installation and tells users to install 0.2.1-1 or newer.

Current status

Forgejo/git stable release is v0.2.1.
GitHub mirror main is synced to Forgejo main at 2f808c1bdf.
Release tracker #1 was retitled/updated for v0.2.1 and now only tracks real remaining announcement work.
Verified that luarocks install forge.nvim 0.3.0-1 previously succeeded from the uploaded source rock, so missing git tag/release state was not enough to neutralize it.
Force-replaced 0.3.0-1 on LuaRocks with a tombstone source rock using a temporary API key. This is the equivalent cleanup path available without a LuaRocks web session.
Verified from https://luarocks.org after clearing local cache that luarocks install forge.nvim 0.3.0-1 now fails with the revocation message: install forge.nvim 0.2.1-1 or newer.

Notes

LuaRocks still displays a 0.3.0-1 version row because this was not a web-session delete/archive operation. The artifact is neutralized for installs: the public rockspec and source rock now build-fail intentionally instead of installing the mistaken release.

Context

Remote Forgejo CI cannot currently be awaited because the Spark runner is down; use local verification for code/doc PRs while runner capacity is unavailable.

## Problem The corrected zerover release surface is reconciled enough for users: LuaRocks still has a historical `0.3.0-1` row, but the artifact has been force-replaced with a tombstone source rock that fails installation and tells users to install `0.2.1-1` or newer. ## Current status - [x] Forgejo/git stable release is v0.2.1. - [x] GitHub mirror main is synced to Forgejo main at 2f808c1bdf2e87eb0ae33995d7870b83b9299920. - [x] Release tracker #1 was retitled/updated for v0.2.1 and now only tracks real remaining announcement work. - [x] Verified that `luarocks install forge.nvim 0.3.0-1` previously succeeded from the uploaded source rock, so missing git tag/release state was not enough to neutralize it. - [x] Force-replaced `0.3.0-1` on LuaRocks with a tombstone source rock using a temporary API key. This is the equivalent cleanup path available without a LuaRocks web session. - [x] Verified from `https://luarocks.org` after clearing local cache that `luarocks install forge.nvim 0.3.0-1` now fails with the revocation message: install `forge.nvim 0.2.1-1` or newer. ## Notes LuaRocks still displays a `0.3.0-1` version row because this was not a web-session delete/archive operation. The artifact is neutralized for installs: the public rockspec and source rock now build-fail intentionally instead of installing the mistaken release. ## Context Remote Forgejo CI cannot currently be awaited because the Spark runner is down; use local verification for code/doc PRs while runner capacity is unavailable.

barrettruth added the

bug

label

2026-05-09 00:46:57 +00:00

barrettruth referenced this issue

2026-05-09 00:47:16 +00:00

Tracker: release-preview readiness follow-up #667

barrettruth referenced this issue

2026-05-09 00:58:22 +00:00

release v0.2.1 follow-up #1

barrettruth commented

2026-05-09 00:58:44 +00:00

Author

Owner

Progress from this pass:

GitHub mirror main is now synced to Forgejo main at 2f808c1bdf2e87eb0ae33995d7870b83b9299920.
Issue #1 is retitled/body-updated to release v0.2.1 follow-up; #634 is checked off and the only remaining item there is the r/neovim + Matrix announcement.
LuaRocks still lists forge.nvim 0.3.0-1. I tried the old luarocks-admin remove flow with the downloaded forge.nvim-0.3.0-1.rockspec; it cannot update https://luarocks.org because that admin command is rsync-server based. The documented LuaRocks HTTP API only exposes upload/check/upload_rock endpoints, not delete/archive.

Remaining action: delete/archive the mistaken 0.3.0-1 from the LuaRocks web UI or another authenticated admin path. I did not recreate a v0.3.0 tag/release because this repo intentionally corrected back to the zerover v0.2.1 line.

Progress from this pass: - GitHub mirror `main` is now synced to Forgejo `main` at `2f808c1bdf2e87eb0ae33995d7870b83b9299920`. - Issue #1 is retitled/body-updated to `release v0.2.1 follow-up`; `#634` is checked off and the only remaining item there is the r/neovim + Matrix announcement. - LuaRocks still lists `forge.nvim 0.3.0-1`. I tried the old `luarocks-admin remove` flow with the downloaded `forge.nvim-0.3.0-1.rockspec`; it cannot update `https://luarocks.org` because that admin command is rsync-server based. The documented LuaRocks HTTP API only exposes upload/check/upload_rock endpoints, not delete/archive. Remaining action: delete/archive the mistaken `0.3.0-1` from the LuaRocks web UI or another authenticated admin path. I did not recreate a `v0.3.0` tag/release because this repo intentionally corrected back to the zerover `v0.2.1` line.

barrettruth commented

2026-05-09 02:51:39 +00:00

Author

Owner

LuaRocks cleanup completed via equivalent authenticated cleanup: 0.3.0-1 was force-replaced with a tombstone rockspec/source rock using a temporary API key.

Verification:

cleared local cached forge.nvim-0.3.0-1 files;
luarocks --tree <tmp> --server=https://luarocks.org install forge.nvim 0.3.0-1 now exits 1;
the install output prints: forge.nvim 0.3.0-1 was revoked; install forge.nvim 0.2.1-1 or newer.;
the public manifest rockspec now contains the tombstone build command.

LuaRocks cleanup completed via equivalent authenticated cleanup: `0.3.0-1` was force-replaced with a tombstone rockspec/source rock using a temporary API key. Verification: - cleared local cached `forge.nvim-0.3.0-1` files; - `luarocks --tree <tmp> --server=https://luarocks.org install forge.nvim 0.3.0-1` now exits 1; - the install output prints: `forge.nvim 0.3.0-1 was revoked; install forge.nvim 0.2.1-1 or newer.`; - the public manifest rockspec now contains the tombstone build command.

barrettruth closed this issue

2026-05-09 02:51:49 +00:00