Resume source-bound Gallery-only publication on retry #513

Outcome

A retry after PowerShell Gallery publication succeeds but GitHub Release creation fails resumes the same release version instead of publishing a new version for the same commit.

Context

The stable flow correctly publishes to PowerShell Gallery before creating its GitHub Release. Resolve-PSModuleVersion currently selects the highest version across the Gallery and GitHub Releases. If the Gallery contains v1.2.4 but GitHub release creation fails, a rerun resolves v1.2.5 and publishes it, leaving the v1.2.4 package without its matching GitHub Release and tag.

Release-PSModule can resume an existing GitHub Release's asset upload, but the workflow must reach that action with the original resolved version first.

Acceptance criteria

• A retry detects a Gallery-only publication for the same stable release context and reuses its version.
• The retry skips duplicate Gallery publication and resumes GitHub Release/tag creation for the exact tested commit.
• A different commit or release context cannot reuse an unrelated Gallery package.
• Focused tests cover Gallery success followed by GitHub-release failure, then a rerun.

Related

• Follow-up from the publication/release split in ⚙️ [Maintenance]: Publish and release execution paths are now decoupled #407.

Ownership proof and recovery safety

The complete review of #531 confirmed that a Gallery-only version currently has no source/artifact ownership proof. A version number or a current mutable reference is not evidence that the package belongs to the retry. Preserve the original same-version recovery outcome only when the exact source, artifact, and release context can be established; unavailable proof must fail explicitly rather than claim an unrelated legacy package.

The publication-preflight behavior is tracked separately in #547 through the native dependency. Resolve proof discovery and version selection together with the Gallery publisher and callable workflow under one owner; do not duplicate release-decision policy or use the unrefined checksum proposal as authority.

Technical decisions

Use the existing immutable consumer source, resolved release context, and artifact evidence where available. Define the minimum missing provenance mechanism through source inspection and isolated experiments before Build. Preserve existing supported settings/caller inputs, existing consumer metadata, and published version contents. No new scalar DefaultBump input, general journal framework, live publication, or tag/label/ruleset mutation is implied.

Legacy packages without provable ownership require a clear safe recovery/roll-forward outcome, not an implicit reuse. Required consumer compatibility/adoption effects belong in the eventual PR/release record; current operating guidance remains evergreen.

Implementation plan

• Capture the Gallery-success/GitHub-failure/retry defect and foreign or missing-ownership cases with non-sensitive fixtures.
• Establish the source/artifact proof contract, minimum required metadata, and safe legacy behavior before implementation.
• Resolve a proven same-context Gallery-only version without taking a new number, and reject unproven or foreign candidates.
• Skip only the proven duplicate Gallery upload and resume GitHub completion for the exact source/artifact under the preflight contract.
• Demonstrate same-version/same-artifact recovery, conflicting source, unavailable proof, and API-failure behavior; finish current documentation and full review without publishing real artifacts.