Catch burned release tags and report failed releases

Releases are immutable, so a published release's tag can't be moved or
reused even when its release run fails. v2.11.8 and v2.11.9 were tagged
one ahead of the package version at their commits, failed the release
workflow's tag/version check, and left nothing on PyPI or Docker Hub.
Only the person who published them was notified.

- Version Check now fails when v<version> is already a tag, since PyPI
  alone can't tell that a version has been burned.
- The release workflow opens an issue for the team when it fails, with
  the run, the tag, the package version and what to do next.
- Fold the never-published 2.11.7 and 2.11.8 changelog entries into
  2.11.10, which is the first release to ship them.

Author: lelia

.github/workflows/release.yml

@@ -9,6 +9,7 @@ jobs:
     permissions:
       id-token: write
       contents: read
+      issues: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -123,3 +124,44 @@ jobs:
             socketdev/cli:${{ env.VERSION }}
           build-args: |
             CLI_VERSION=${{ env.VERSION }}
+
+      # Releases are immutable, so a failed run leaves a published GitHub release whose
+      # tag can never be reused, with nothing on PyPI or Docker Hub behind it. A failed
+      # run only notifies whoever published the release, so raise it where the team
+      # will see it.
+      - name: Open an issue for the failed release
+        if: failure()
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          VERSION: ${{ env.VERSION }}
+        with:
+          script: |
+            const release = context.payload.release;
+            const runUrl =
+              `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}` +
+              `/actions/runs/${context.runId}`;
+            const body = [
+              `@SocketDev/customer-engineering the release workflow for [${release.tag_name}](${release.html_url}) ` +
+                `(published by @${release.author.login}) failed: ${runUrl}`,
+              '',
+              `- Tag: \`${release.tag_name}\``,
+              `- Package version at that commit: \`${process.env.VERSION || 'unknown'}\``,
+              '',
+              'Check the run for which step failed. If it failed before "Publish to PyPI", nothing reached PyPI or ' +
+                'Docker Hub, but the GitHub release is immutable and its tag can never be reused.',
+              '',
+              'Before publishing another release:',
+              '',
+              '1. Edit this release\'s notes to say it was not published and name the release that replaces it.',
+              '2. If the tag and the package version disagree, merge a PR that bumps the version to one with no ' +
+                'existing tag (the Version Check workflow enforces this), then publish a release whose tag matches ' +
+                'that version exactly. Do not pick the next tag number from the releases list.',
+            ].join('\n');
+
+            const created = await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `Release ${release.tag_name} failed`,
+              body,
+            });
+            core.error(`Release failed; opened #${created.data.number}`);

.github/workflows/version-check.yml

@@ -44,6 +44,7 @@ jobs:
           python3 <<'PY'
           import json
           import os
+          import subprocess
           import tomllib
           import urllib.request
           from packaging import version
@@ -96,6 +97,21 @@ jobs:
               )
               raise SystemExit(1)
 
+          # Releases are immutable: once a v<version> release is published, its tag can't
+          # be moved or reused, even when that release failed and nothing reached PyPI.
+          # PyPI alone misses that, so a burned tag would only surface when the release
+          # run fails after the merge.
+          tag = f"v{os.environ['PR_VERSION']}"
+          if subprocess.run(
+              ["git", "rev-parse", "--quiet", "--verify", f"refs/tags/{tag}"],
+              capture_output=True,
+          ).returncode == 0:
+              print(
+                  f"❌ Tag {tag} already exists, so {pr_ver} can never be released "
+                  f"(latest PyPI release: {pypi_ver}). Bump to a version with no tag."
+              )
+              raise SystemExit(1)
+
           if pr_ver < main_ver:
               print(
                   f"❌ Version moves backwards: main is {main_ver}, PR is {pr_ver}."

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## 2.11.10
 
+Versions 2.11.7 through 2.11.9 were never published to PyPI or Docker Hub. The
+GitHub releases tagged `v2.11.8` and `v2.11.9` have no packages behind them;
+their changes ship here.
+
 ### Fixed: report why a new repository couldn't be created
 
 - When a repository isn't in Socket yet and the API token can't create it, the
@@ -11,21 +15,10 @@
 - After the CLI creates a missing repository, its logging is no longer silenced
   for the rest of the run.
 
-## 2.11.8
-
 ### Changed: bump pinned Coana CLI to 15.14.0
 
-- Bumped the pinned reachability engine (the Coana CLI) from `15.13.3` to
-  `15.14.0`. See the
-  [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
-  for engine changes.
-
-## 2.11.7
-
-### Changed: bump pinned Coana CLI to 15.13.3
-
 - Bumped the pinned reachability engine (the Coana CLI) from `15.13.2` to
-  `15.13.3`. See the
+  `15.14.0`. See the
   [reachability analysis changelog](https://docs.socket.dev/docs/reachability-analysis-changelog)
   for engine changes.