From a31c8d6d8ce6494453f70f088e75c05fefec2cde Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Fri, 24 Jul 2026 14:57:22 +0000 Subject: [PATCH 1/3] Surface the Forge API response in the deploy step curl --fail discards the response body, so a failed publish reports only an HTTP status (the simp-gpasswd 2.0.0 release died with a bare 403). Capture the body and status, print both, and fail on any non-2xx result so the Forge's own error message lands in the job log. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp --- .../pupmod/_github/workflows/tag_deploy.yml | 20 ++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml index ecb731c..29f13d7 100644 --- a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml +++ b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml @@ -186,8 +186,22 @@ jobs: run: bundle exec pdk build --force - name: Deploy to Puppet Forge (skipped when prerelease) run: | - curl -X POST --silent --show-error --fail \ + file="$(find "$PWD/pkg" -name '*.tar.gz')" + echo "Uploading: ${file}" + response="$(mktemp)" + http_code="$(curl -X POST --silent --show-error \ --user-agent "$FORGE_USER_AGENT" \ --header "Authorization: Bearer ${PUPPETFORGE_API_TOKEN}" \ - --form "file=@$(find $PWD/pkg -name ''*.tar.gz'')" \ - "$FORGE_API_URL" + --form "file=@${file}" \ + --write-out '%{http_code}' \ + --output "$response" \ + "$FORGE_API_URL")" + echo "Forge API response (HTTP ${http_code}):" + cat "$response"; echo + case "$http_code" in + 2*) ;; + *) + echo "::error ::Puppet Forge upload failed with HTTP ${http_code} (see response above)" + exit 1 + ;; + esac From 690e15b528f2b342638d117528da47781b6c43d3 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Fri, 24 Jul 2026 15:12:42 +0000 Subject: [PATCH 2/3] Preserve the built module archive as a workflow artifact A failed Forge upload previously left nothing to download - the tarball existed only on the runner and the GitHub release carries no assets. Upload it before attempting the Forge POST so every tag run, pass or fail, leaves the exact archive available from the run page. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp --- .../profile/files/pupmod/_github/workflows/tag_deploy.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml index 29f13d7..034a3bf 100644 --- a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml +++ b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml @@ -184,6 +184,12 @@ jobs: bundler-cache: true - name: Build Puppet module (PDK) run: bundle exec pdk build --force + - name: Upload module archive as a workflow artifact + uses: actions/upload-artifact@v7 + with: + name: puppet-module + path: pkg/*.tar.gz + if-no-files-found: error - name: Deploy to Puppet Forge (skipped when prerelease) run: | file="$(find "$PWD/pkg" -name '*.tar.gz')" From f713fb1a013cf4fe538b9a3894148200df637716 Mon Sep 17 00:00:00 2001 From: Steven Pritchard Date: Fri, 24 Jul 2026 15:15:05 +0000 Subject: [PATCH 3/3] Attach the module archive to the GitHub release Release assets are permanent and publicly downloadable, unlike workflow artifacts (authenticated, expiring). Uploaded before the Forge POST so a failed publish still leaves the exact archive on the release. --clobber keeps job re-runs idempotent. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01XCnDsYaJDLiP8z8tafz9Tp --- modules/profile/files/pupmod/_github/workflows/tag_deploy.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml index 034a3bf..c935cea 100644 --- a/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml +++ b/modules/profile/files/pupmod/_github/workflows/tag_deploy.yml @@ -190,6 +190,10 @@ jobs: name: puppet-module path: pkg/*.tar.gz if-no-files-found: error + - name: Attach module archive to the GitHub release + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: gh release upload "${GITHUB_REF_NAME}" pkg/*.tar.gz --clobber - name: Deploy to Puppet Forge (skipped when prerelease) run: | file="$(find "$PWD/pkg" -name '*.tar.gz')"