Packagist: Releases gone missing

[Riimu]

I have absolutely no idea how it happen or how to reproduce it (since it has happened completely without my interaction), but all the release tags went missing from my packagist package riimu/kit-csrf. Forcing an update from the packagist page reloaded the release tags back into packagist. If you look at the download statistics for the package, you can see that there has been download activity for it for past few months, but it seems now they are not related to any of the release tags (even dev-master).

I only noticed this as it was reported to me in my repository's issue. Though I have little more information to provide, as there hasn't even been any activity to my github repository for a while, but having releases suddenly go missing and without warning from packagist seems a bit alarming.

[alcohol]

/cc @seldaek you're the only one with sufficient access to have a glimpse into the server logs I believe?

[Seldaek]

We've had some issues with github requests a few days ago and I guess in a stroke of bad luck it's possible that the first request fetching the repo worked but then subsequent requests fetching composer.json failed so it assumed those branches were deleted/invalidated and they were deleted. We used to have a limit of at least >1week since last update before we deleted because that's safer in case of intermittent errors but it got removed because people always complained that stuff wasn't deleted fast enough.

I'm thinking the best fix would be to make sure we fail hard when we encounter something else than a 200 or 404. That needs to be done in the GitHubDriver in composer though, but I'm not sure if there are any unintended side effects.

[Seldaek]

I am working on a fix for this as it has been reoccurring lately.