From 335f449c25bd7f5627f76a550c28b42fb4e03c3d Mon Sep 17 00:00:00 2001
From: David de Hilster <dehilster@gmail.com>
Date: Sat, 26 Sep 2026 17:57:25 -0400
Subject: [PATCH] Retry artifact uploads and report failed tag releases

v2.2.39 (engine v4.2.0) never reached PyPI: the Linux wheel job built
every wheel, then GitHub rejected the artifact finalize with a 403, so
upload_pypi and the release were skipped. Nothing reported it, and the
successful "Update nlp-engine & publish" run made it look shipped.

- Retry each upload-artifact step once (overwrite: true).
- On a v* tag, if any job fails, open an issue linking the run.

Refs #38, VisualText/nlp-engine#744

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 88 +++++++++++++++++++++++++++++++++--
 1 file changed, 84 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1e5c80b..7c82773 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,11 +32,26 @@ jobs:
           # Uncomment for testing
           # CIBW_BUILD: "cp312-*"
 
-      - uses: actions/upload-artifact@v4
+      # GitHub's artifact service occasionally rejects the finalize call
+      # (v2.2.39: "Failed to FinalizeArtifact ... (403) Forbidden" after
+      # every wheel had built), which skipped upload_pypi and silently
+      # withheld the release. Retry once, overwriting any half-made artifact.
+      - name: Upload artifact
+        id: upload
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
         with:
           name: cibw-wheels-linux
           path: ./wheelhouse/*.whl
 
+      - name: Upload artifact (retry)
+        if: steps.upload.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: cibw-wheels-linux
+          path: ./wheelhouse/*.whl
+          overwrite: true
+
   build_wheels_macos:
     name: Build wheels on MacOS
     # Otherwise people with older Macs are out of luck
@@ -72,10 +87,21 @@ jobs:
           CIBW_BUILD_VERBOSITY: 3
           CIBW_CONFIG_SETTINGS: "cmake.args='-DCMAKE_BUILD_TYPE=Release;-DCMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/vcpkg/scripts/buildsystems/vcpkg.cmake'"
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload artifact
+        id: upload
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: cibw-wheels-macos
+          path: ./wheelhouse/*.whl
+
+      - name: Upload artifact (retry)
+        if: steps.upload.outcome == 'failure'
+        uses: actions/upload-artifact@v4
         with:
           name: cibw-wheels-macos
           path: ./wheelhouse/*.whl
+          overwrite: true
 
   build_wheels_windows:
     name: Build wheels on Windows
@@ -116,11 +142,22 @@ jobs:
           CIBW_REPAIR_WHEEL_COMMAND_WINDOWS: "delvewheel repair --no-mangle-all --add-dll icuin78.dll --add-path ${{ github.workspace }}/vcpkg/installed/x64-windows-release/bin -w {dest_dir} {wheel}"
           CIBW_CONFIG_SETTINGS: "cmake.args='-A x64;-DCMAKE_BUILD_TYPE=Release;-DCMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/vcpkg/scripts/buildsystems/vcpkg.cmake'"
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload artifact
+        id: upload
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
         with:
           name: cibw-wheels-windows
           path: ./wheelhouse/*.whl
 
+      - name: Upload artifact (retry)
+        if: steps.upload.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: cibw-wheels-windows
+          path: ./wheelhouse/*.whl
+          overwrite: true
+
   build_sdist:
     name: Build source distribution
     runs-on: ubuntu-latest
@@ -132,10 +169,21 @@ jobs:
       - name: Build sdist
         run: pipx run build --sdist
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload artifact
+        id: upload
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: cibw-sdist
+          path: dist/*.tar.gz
+
+      - name: Upload artifact (retry)
+        if: steps.upload.outcome == 'failure'
+        uses: actions/upload-artifact@v4
         with:
           name: cibw-sdist
           path: dist/*.tar.gz
+          overwrite: true
 
   release:
     name: Make release
@@ -184,3 +232,35 @@ jobs:
           path: dist
           merge-multiple: true
       - uses: pypa/gh-action-pypi-publish@release/v1
+
+  # A failed tag build publishes nothing, yet the upstream "Update nlp-engine &
+  # publish" run still reports success, so the gap goes unseen (v2.2.39 sat
+  # unpublished for five days). Open an issue so the failure is visible.
+  notify_failure:
+    name: Report failed release
+    runs-on: ubuntu-latest
+    needs:
+      - build_sdist
+      - build_wheels_linux
+      - build_wheels_windows
+      - build_wheels_macos
+      - release
+      - upload_pypi
+    if: failure() && startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      issues: write
+    steps:
+      - name: Open issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh issue create \
+            --title "Release $TAG was not published to PyPI" \
+            --body "The *Build and upload to PyPI* run for \`$TAG\` failed, so NLPPlus $TAG is not on PyPI.
+
+          Run: $RUN_URL
+
+          If the failure is transient (for example an artifact upload 403), use *Re-run failed jobs* on that run."