golang/go

x/pkgsite: immutable releases are not reflected

Closed this issue · 3 comments

tats-u commented

What is the URL of the page with the issue?

https://pkg.go.dev/github.com/tats-u/goldmark-cjk-friendly#

What is your user agent?

Not concerned with
All are affected!

Screenshot

tats-u/goldmark-cjk-friendly#1

What did you do?

  • Create a Go package
  • Create a first release
  • Turn the immutable releases on in Repository settings
  • Create a release again
  • go get in another Go project or visit the pkg.go.dev page

https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

What did you expect to see?

The newer release that has just been created is available

What did you see instead?

The newer release is not downloadable or displayed

https://go.dev/ref/mod#module-path

If the module is released at major version 2 or higher, the module path must end with a major version suffix like /v2. This may or may not be part of the subdirectory name. For example, the module with path golang.org/x/repo/sub/v2 could be in the /sub or /sub/v2 subdirectory of the repository golang.org/x/repo.

Unlike many projects, the Go project does not use GitHub Issues for general discussion or asking questions. GitHub Issues are used for tracking bugs and proposals only.

For questions please refer to https://github.com/golang/go/wiki/Questions

tats-u commented

What a terrible pitfall it is. Thank you for your quick investigation.

Unlike many projects, the Go project does not use GitHub Issues for general discussion or asking questions. GitHub Issues are used for tracking bugs and proposals only.

What if this were actually a bug in pkg.go.dev? I just reported a "potential bug" in pkg.go.dev system.

tats-u commented

Managed to release a new v2 version. It turned out to have nothing to do with immutable releases.