fix: treat rejected push to forc.pub-index as failure

[ironcev]

This PR fixes the issue of "phantom versions", the package versions visible on forc.pub but not existing on forc.pub-index. One such example is, e.g., the merkle v0.26.2.

The reason for existence of "phantom versions" were race conditions caused by publishing scripts running from the sway-standards and sway-libs repositories. libgit2's push returns Ok even when the server rejects a ref update (a non-fast-forward because a concurrent publish advanced the branch). The rejection is only reported through the callback, so a non-empty status must be turned into a hard error.

Without this, a dropped push looks like success and the caller records the package version in the database while the index commit never landed, which causes the "phantom versions" we currently have.

The PR:

• turns rejections reported via callback as hard errors.
• retries to push to forc.pub-index a small number of times.

Note that instead of retires we could have a single-writer coordination on forc.pub. This requires a more complex implementation, and since we expect congestion to be very rare, the error reporting + retries is acceptable as a solution, at least for the time being.

Additionally, the PR removes the unused "Install forc for tests" CI step. The step is not used by any other steps and was failing in installing/compiling the old v0.65.0 version of forc due to yanked dependencies.

[cursor]

PR Summary

High Risk
Changes synchronous publish/index git push semantics and retry behavior on the path that must stay consistent with the database; incorrect handling could still block publishes or leave index/DB out of sync.

Overview
Fixes phantom versions on forc.pub (versions in the DB but missing from forc.pub-index) when concurrent publishes race on the single index branch.

Git push handling: libgit2 can return success even when the remote rejects a ref update; rejections are now surfaced via push_update_reference and turned into hard errors instead of being treated as a successful push.

Publish retry loop: process_repo re-syncs to the remote tip, re-applies the package entry, commits, and pushes again (up to 3 attempts with short backoff). Version collisions and authentication errors are not retried.

CI: Documents why cargo-binstall is installed in backend CI and drops the redundant pinned forc@0.65.0 install step.

Tests: Mock git builder scenarios cover transient push failures, max-attempt exhaustion, and non-retried auth failures.

^{Reviewed by Cursor Bugbot for commit 6304725. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
forc-pub	Ready	Preview	Aug 25, 2026 9:58am

[ironcev]

👍