chore: retract the mistyped v0.20.0 tag via a v0.20.1 retraction release - #21
Merged
Merged
Conversation
v0.20.0 was pushed by mistake for v0.2.0 and points at the same commit. The Go module proxy and sum.golang.org have already recorded it, so it cannot be removed, and as the highest 0.x version it makes `go install ...@latest` resolve to v0.20.0 indefinitely. A retract directive only takes effect from a version at or above the highest published one, so v0.20.1 will be tagged from this commit to carry it and retracts itself as well. After that, @latest skips both and resolves to the highest real release. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A tag
v0.20.0(a typo forv0.2.0, same commit) was pushed and its release workflow ran. The GitHub release has since been deleted, but the Go module proxy and sum.golang.org already recorded v0.20.0, and that record is permanent:So
go install github.com/slashdevops/machineid/cmd/machineid@latestinstalls a binary calling itself v0.20.0, andmachineid update -method gowill keep doing so, because v0.20.0 sorts above every real 0.x release until v0.21.0.Fix (the sanctioned Go mechanism)
Add
retractforv0.20.0and for the retraction release itself, then tag this commit asv0.20.1. Go reads retractions from the highest version, so the directive must ship in a version above v0.20.0; after that@latestresolves to the highest non-retracted version, i.e. v0.2.0 (or later).After merging, by hand
git tag -a v0.20.1 -m "retraction-only release, see go.mod" && git push origin v0.20.1gh release delete v0.20.1 --yes. GitHub orders "latest" by semver, so a v0.20.1 release would otherwise become whatmachineid updateinstalls.git push origin :refs/tags/v0.20.0.go list -m github.com/slashdevops/machineid@latestprints v0.2.0 (proxy caches for a few minutes).No code change; go.mod only.
🤖 Generated with Claude Code