fix goreleaser again

.tangled/workflows/release-credential-helper.yml

@@ -37,4 +37,8 @@ steps:
       export REPO_URL="at://${TANGLED_REPO_DID}/sh.tangled.repo/${REPO_RKEY}"
       export APP_PASSWORD="${PUBLISH_APP_PASSWORD}"
 
+      # Log in once here so parallel publish-artifact.sh invocations share the
+      # same session file instead of racing on goat's auth-session.json.
+      goat account login -u "${TANGLED_REPO_DID}" -p "${APP_PASSWORD}"
+
       goreleaser release --clean

scripts/publish-artifact.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 set -e
 
-# Serialize across parallel invocations from goreleaser. goat stores its session
-# in a single file (~/.local/state/goat/auth-session.json), so concurrent logins
-# race on it, and the PDS gets slammed by simultaneous uploads.
+# Serialize across parallel invocations from goreleaser to avoid slamming the
+# PDS with simultaneous uploads. `goat account login` happens once in the
+# release workflow before goreleaser runs, so this script just reuses the
+# existing session.
 exec 9>/tmp/atcr-publish-artifact.lock
 flock 9
 
@@ -19,8 +20,6 @@ retry() {
   done
 }
 
-retry goat account login -u "${TANGLED_REPO_DID}" -p "${APP_PASSWORD}"
-
 TAG_HASH=$(git rev-parse "$TANGLED_REF_NAME")
 TAG_BYTES=$(printf "$(printf '%s' "$TAG_HASH" | sed 's/../\\x&/g')" | base64 | tr -d '=')