Merge pull request 'mesh-build-go reaches the forge's git when the public proxy is unreachable, and a network failure is no pin (issue 1966)' (#647) from fix/1966-contracts-goproxy into main

modules/mesh-build-go/cmd/mesh-build-go/fetch.go

@@ -334,7 +334,11 @@ func (m *Module) goEnv() []string {
 		// The Go seat first, the public proxy second, the forge's git last (CAT-BG3, E11: direct goes in the first
 		// change after mesh-sdk's and mesh-contracts' first numbered versions are in the Go seat); no GOPRIVATE, and
 		// the checksum database off for the forge's paths, which go.sum and the builder's h1: digest guard instead.
-		env = append(env, "GOPROXY="+proxy+","+PublicGoProxy+",direct", "GONOSUMDB="+ForgeGoPaths, "GOPRIVATE=")
+		// The seat goes on to the public proxy only on a 404 or 410 (",": a package it does not hold), so a seat that
+		// fails otherwise (5xx, refused, timeout) fails the fetch loudly; the public proxy goes on to direct on any
+		// failure ("|"): a public proxy the node cannot reach stopped the fetch before direct, and direct reaches the
+		// forge's git for a package the seat does not hold (issue 1966, ADR 0605 §6).
+		env = append(env, "GOPROXY="+proxy+","+PublicGoProxy+"|direct", "GONOSUMDB="+ForgeGoPaths, "GOPRIVATE=")
 	} else {
 		env = append(env, "GOPRIVATE="+ForgeGoPaths)
 	}

modules/mesh-build-go/cmd/mesh-build-go/fetch_test.go

@@ -153,7 +153,7 @@ func TestFetchAsksGitForTheSshRemoteAndDownloadsEachModule(t *testing.T) {
 	}
 	m.GoSeatFile = seat
 	env := strings.Join(m.goEnv(), " ")
-	for _, want := range []string{"GOPROXY=http://forge.mesh:3000/api/packages/novox/go,https://proxy.golang.org,direct", "GONOSUMDB=git.novox.be", "GOPRIVATE= "} {
+	for _, want := range []string{"GOPROXY=http://forge.mesh:3000/api/packages/novox/go,https://proxy.golang.org|direct", "GONOSUMDB=git.novox.be", "GOPRIVATE= "} {
 		if !strings.Contains(env+" ", want) {
 			t.Errorf("with the Go seat bound the environment lacks %q: %s", want, env)
 		}

modules/mesh-build-go/cmd/mesh-build-go/versions.go

@@ -108,7 +108,7 @@ const (
 // reset connection), not of a version or a checksum that is wrong.
 func networkFailure(s string) bool {
 	s = strings.ToLower(s)
-	for _, w := range []string{"i/o timeout", "no such host", "temporary failure in name resolution", "connection refused", "connection reset", "tls handshake timeout", "lookup "} {
+	for _, w := range []string{"i/o timeout", "no such host", "temporary failure in name resolution", "connection refused", "connection reset", "tls handshake timeout", "network is unreachable", "no route to host", "lookup "} {
 		if strings.Contains(s, w) {
 			return true
 		}
@@ -348,5 +348,10 @@ func comparePre(a, b string) int {
 // "invalid version" it wraps it in): it labels a commit the forge holds on no pull request head (placePin), and decides
 // nothing; every other failure is the network's or the forge's.
 func unknownRevision(failure string) bool {
+	// go words any failure of a proxy as "invalid version: ..." (issue 1966): a failure of the network is not go knowing
+	// no such revision, whatever else the text says.
+	if networkFailure(failure) {
+		return false
+	}
 	return strings.Contains(failure, "unknown revision") || strings.Contains(failure, "invalid version")
 }

modules/mesh-build-go/cmd/mesh-build-go/versions_test.go

@@ -49,6 +49,10 @@ func TestAnAskedVersionIsWrittenIntoTheModfileWhateverGoModNames(t *testing.T) {
 			built:  commitSHA, said: "placed from the pull request's head"},
 		{name: "a lookup that times out is no pin", asked: offHead, failing: true, failsWith: "i/o timeout",
 			answer: `{"Path":"` + sdk + `","Error":"git.novox.be/novox/mesh-sdk/go@` + offHead + `: dial tcp: lookup git.novox.be on 10.10.0.3:53: read udp 10.10.0.3:42292->10.10.0.3:53: i/o timeout"}`},
+		// Issue 1966: go words a public proxy it cannot reach as "invalid version"; that is the network's failure, not an
+		// unknown revision, so a trunk commit on no pull request head is not labelled "on no pull request head".
+		{name: "an unreachable proxy worded invalid version is no pin", asked: offHead, failing: true, failsWith: "network is unreachable",
+			answer: `{"Path":"` + sdk + `","Error":"invalid version: Get \"https://proxy.golang.org/` + sdk + `/@v/` + offHead + `.info\": dial tcp [2a00:1450::1]:443: connect: network is unreachable"}`},
 		// The forge's own listing failing is a failure that may be retaken too, with its own cause (review 3).
 		{name: "a forge that cannot be listed is retaken", asked: commitSHA, failing: true, forgeDown: true,
 			failsWith: "unable to access the forge",