Repository navigation
Conversation
This was referenced Oct 25, 2026
ericmj
marked this pull request as ready for review
October 29, 2026 14:25
Publishers whose API key or workload identity requires approval need to tell a staged release from a published one. Recognize staged package and documentation responses, print the approval URL, expiry and artifact SHA-256 values, and add mix hex.publish --wait to open the review page and poll until approval, rejection or expiry. Polling follows the configured repository, binds approval to the checksums Hexpm reported for the staged release and renews workload identity tokens when Hexpm rejects them as expired. Combined package and docs publishes detect a package restage before accepting approval. A staged new package's organization transfer waits for approval with --wait and is otherwise left for after approval. The status API is vendored from hex_core. Integration CI uses the hexpm staged-publishing branch; restore HEXPM_BRANCH: main after that server change merges.
ericmj
force-pushed
the
staged-publishing
branch
from
October 30, 2026 20:05
ca82a50 to
92af505
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishers whose API key or workload identity requires approval need to distinguish a staged release from a published one. Recognize staged package and documentation responses, print the approval URL, expiry and artifact SHA-256 values, and add
mix hex.publish --waitto open the review page and poll for approval, rejection or expiry.Polling follows the configured repository, binds approval to the checksums Hexpm reported for the staged release and renews workload-identity tokens when Hexpm rejects them as expired. Combined package/docs publishes detect a package restage before accepting approval. Vendor the status API from hexpm/hex_core#255.
A staged new package's organization transfer waits for approval with
--waitand is otherwise left for after approval.Integration CI uses the companion server branch from hexpm/hexpm#2082. Restore
HEXPM_BRANCH: mainafter that server change merges. Proposal: https://gist.github.com/ericmj/e0a2cff04afa2a09a89fee726e9a5759.The client suite, including its integration tests, passed 903 tests (2 skipped) against hexpm/hexpm@b4a567f. Formatter and diff checks passed.