[silug]

Problem

release_rpms.yml builds el8, el9 and el10 in parallel matrix legs. Every leg signs with the same key, produces the same RPM-GPG-KEY-SIMP-UNSTABLE-2.pub.asc, and clobbers and uploads that one asset. The legs race each other: one leg's delete or upload lands between another leg's listReleaseAssets and uploadReleaseAsset. The losing leg fails, and fail-fast cancels the rest. Examples:

• simp/pupmod-simp-sssd 10.1.2 (run 33689600433, el8): HttpError: Validation Failed: {"resource":"ReleaseAsset","code":"already_exists","field":"name"}
• simp/pupmod-simp-simp 9.0.1 (run 32891967020): el9 failed with HttpError: Not Found … #update-a-release-asset, el8 was cancelled, el10 succeeded.

Re-running usually gets past it, which is why the failure has looked intermittent.

Fix

A new upload_gpg_file env, matrix.os == fromJSON(github.event.inputs.build_container_oses)[0]. Only that leg adds the .pub.asc to its upload list; every leg still uploads its own RPMs, whose names are distinct per %{dist}. A dispatch with a custom build_container_oses still attaches the key exactly once.

Testing

• actionlint reports nothing new; it only flags the existing ubuntu-26.04 runner label it doesn't know yet.
• rspec: 256 examples, 0 failures; BoltSpec plan specs: 31 examples, 0 failures.
• The repolist resolves (via list_github_repos.rb) to exactly 80 repos: the 83 simp repos that carry release_rpms.yml, minus the three exclusions below.

Sync session

bolt plan run puppetsync config=20261025-release-rpms-gpg-key-race repolist=20261025-release-rpms-gpg-key-race

• Config data/sync/configs/20261025-release-rpms-gpg-key-race.yaml: merge_github_workflows scoped to release_rpms.yml, with project_types widened from the pupmod default to rubygem (rubygem-simp-cli) and simp_unknown (the packaging repos). The default preserve_keys apply. There's no version bump.
• Repolist data/sync/repolists/20261025-release-rpms-gpg-key-race.yaml: github-org with pupmod-*, puppet-*, rubygem-simp-cli and the eight packaging repos (pkg-r10k, simp-adapter, simp-doc, simp-environment-skeleton, simp-gpgkeys, simp-rsync-skeleton, simp-selinux-policy, simp-utils). merge_github_workflows creates a workflow that a repo lacks, so the repolist names only repos that already have the file: it has no rubygem-* glob, and it excludes pupmod-simp-ufw.
• Template header: line 6 now says "standardized asset baseline" like the other shared templates, because the file goes to non-module repos too. simp-adapter, simp-doc and simp-utils already have that header. In the module repos the line changes along with the fix.

Expected result: I diffed every repo's current release_rpms.yml against main's template. 76 match it exactly, three differ only in the header line, and mockup differs only in runs-on, which is preserved. So each of the 80 PRs should change only the key-upload lines plus, in the module repos, the header comment.

Excluded:

• pupmod-voxpupuli-selinux and pupmod-simp-haveged, as in every session.
• pupmod-simp-compliance_markup. Its release_rpms.yml and tag_deploy.yml predate the run-once/matrix split. tag_deploy still dispatches release_rpms once per OS (centos7/centos8) with a build_container_os input. Merging only release_rpms.yml would leave tag_deploy sending an input that no longer exists. The repo has missed every sync since 2026-09-03, and its metadata still says openvox < 9, so it needs its own catch-up session (to be filed separately).

The four baseline PRs mentioned in the first version of this PR (environment-skeleton, rsync-skeleton, gpgkeys, selinux-policy) have merged, and those repos are in the repolist.

🤖 Generated with Claude Code