fix: remove tunnel connectors before cleanup - #9
Merged
Conversation
What changed: - delete Cloudflare connector records before deleting ephemeral tunnels - keep connector and tunnel retries independent - include safe API method/path/status details in cleanup failures - cover active-connector cleanup and exact deletion ordering Why: - Cloudflare retains disconnected connectors and rejects direct tunnel deletion with HTTP 409, which blocked release cleanup after the real-transport test passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Root cause
Release run 32199364309 passed the complete real-Cloudflare database smoke, then failed cleanup because Cloudflare rejected direct deletion of recently connected tunnels. Automatic recovery removed two tunnels but one remained tracked; repeated delayed deletion still failed. Cloudflare documents a dedicated connector cleanup endpoint and notes disconnected connectors can remain tracked for several minutes.
Safety
Recovery still discovers deletion IDs from the validated exact run prefix; downloaded artifact IDs do not drive deletion. DNS-first order, bounded retries, and unrelated/orphan protections are unchanged. Error output includes no token or response body.
Verification
Hosted CI, exact-attempt cleanup, and a protected release rerun are required before publication.