Request to signal completion of the publish operation failed

Error message

Request to signal completion of the publish operation failed: %w

What it means

This error wraps failure of Step 3 of publishing a policy pack: POST to the publish-complete endpoint, which tells the service the archive upload finished and finalizes the published version. Thrown when restCall fails on this final signal call — auth problems, malformed version in the path, or network/5xx errors.

Source

Thrown at pkg/backend/httpstate/client/client.go:2092

	if err != nil {
		return "", fmt.Errorf("Failed to upload compressed PolicyPack: %w", err)
	}

	//
	// Step 3: Signal to the service that the PolicyPack publish operation is complete.
	//

	// If the version tag is empty, an older version of pulumi/policy is being used and
	// we therefore need to use the version provided by the pulumi service.
	version := analyzerInfo.Version
	if version == "" {
		version = strconv.Itoa(resp.Version)
		fmt.Printf("Published as version %s\n", version)
	}
	err = pc.restCall(ctx, "POST",
		publishPolicyPackPublishComplete(orgName, analyzerInfo.Name, version), nil, nil, nil)
	if err != nil {
		return "", fmt.Errorf("Request to signal completion of the publish operation failed: %w", err)
	}

	return version, nil
}

// convertPolicyConfigSchema converts a policy's schema from the analyzer to the apitype.
func convertPolicyConfigSchema(schema *plugin.AnalyzerPolicyConfigSchema) (*apitype.PolicyConfigSchema, error) {
	if schema == nil {
		return nil, nil
	}
	properties := map[string]*json.RawMessage{}
	for k, v := range schema.Properties {
		bytes, err := json.Marshal(v)
		if err != nil {
			return nil, err
		}
		raw := json.RawMessage(bytes)
		properties[k] = &raw

View on GitHub (pinned to 793f7b2e16)

Solutions

Retry the whole publish operation — the pack may be stuck in a pending state otherwise.
Verify the version value used in publishPolicyPackPublishComplete is non-empty and numeric.
Check token validity (`pulumi whoami`) if the publish is long-running.
Inspect the wrapped HTTP status: 4xx → bad version/org/name in path, 5xx → retry.

Example fix

// before
err = pc.restCall(ctx, "POST",
	publishPolicyPackPublishComplete(orgName, analyzerInfo.Name, version), nil, nil, nil)
if err != nil { return "", fmt.Errorf("Request to signal completion of the publish operation failed: %w", err) }
// after
if version == "" { version = "latest" } // or fail fast before building the path
err = pc.restCall(ctx, "POST",
	publishPolicyPackPublishComplete(orgName, analyzerInfo.Name, version), nil, nil, nil)
if err != nil {
	return "", fmt.Errorf("signaling publish completion for %s@%s failed; the pack may need republishing: %w", analyzerInfo.Name, version, err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

// ensure a version exists before signaling completion
if version == "" {
	return errors.New("no version returned by publish; cannot signal completion")
}
if _, err := strconv.Atoi(version); err != nil {
	return fmt.Errorf("non-numeric version %q in completion path", version)
}

Try / catch

err = pc.restCall(ctx, "POST",
	publishPolicyPackPublishComplete(orgName, analyzerInfo.Name, version), nil, nil, nil)
if err != nil {
	// the pack may be pending; safest recovery is to republish
	return "", fmt.Errorf("completion signal failed for %s@%s; republish the pack: %w", analyzerInfo.Name, version, err)
}

Prevention

Fail fast if the service returned no version before building the completion path.
Use long-lived CI tokens so auth doesn't lapse between upload and completion.
On failure, republish the whole pack — partial publishes leave it pending.
Check the wrapped HTTP status to separate bad-path errors (4xx) from transient ones (5xx).

When it happens

Trigger: Calling the completion endpoint after upload with an invalid version string in the URL (e.g. empty version when the service didn't return one), an expired session/token mid-publish, or transient network/5xx failures.

Common situations: CI jobs where the token rotates or expires during a long upload; older service behavior returning no version so the path is built with an empty/invalid version; pack uploaded but never finalized leaving it in a pending state.

Related errors

AI-assisted analysis of pulumi/pulumi@793f7b2e16 (2026-08-31). Data as JSON: /api/errors/85e53cecae02b264. Report an issue: GitHub.