whiteboard-android 2.16.132 stays Queued; new POM/AAR/build.log return HTTP 429 #8106

Problem

Public repository netless-io/whiteboard-android, version 2.16.132, has not become available on JitPack. Requests for the new POM, AAR and build log return HTTP 429 with the plain body Too Many Requests. The previous version 2.16.131 returns HTTP 200 for its POM through the same connection.

• Project: https://jitpack.io/#netless-io/whiteboard-android
• Build log: https://jitpack.io/com/github/netless-io/whiteboard-android/2.16.132/build.log (also returns 429, so no build output is available)
• Tag: https://github.com/netless-io/whiteboard-android/releases/tag/2.16.132
• Tag resolves to commit 5e7a41d7fcd1de3ef0e51974fa9f5eb1ebebd936.

Reproduction

Request the following public URLs:

curl -i https://jitpack.io/com/github/netless-io/whiteboard-android/2.16.132/whiteboard-android-2.16.132.pom
curl -i https://jitpack.io/com/github/netless-io/whiteboard-android/2.16.132/whiteboard-android-2.16.132.aar
curl -i https://jitpack.io/com/github/netless-io/whiteboard-android/2.16.132/build.log

Control request (HTTP 200):

curl -i https://jitpack.io/com/github/netless-io/whiteboard-android/2.16.131/whiteboard-android-2.16.131.pom

Latest request evidence

An earlier comparison at 2026-10-12 06:51:27 UTC also returned 429 through two existing network routes/edges: a4942d18f912d2c2-FRA and a4942d151f65fcff-SIN. We used bounded checks and retained the original tag.

Build status discrepancy

The all-builds API currently lists this version as Queued:
https://jitpack.io/api/builds/com.github.netless-io/whiteboard-android

But the single-build API returns:
https://jitpack.io/api/builds/com.github.netless-io/whiteboard-android/2.16.132

{
  "version": "2.16.132",
  "status": "none",
  "message": "",
  "time": 0,
  "commit": "",
  "ci": false,
  "buildUrl": "",
  "modules": [],
  "image": "",
  "jdk": 0,
  "commitWhen": 0,
  "isTag": false,
  "private": true
}

The repository is public, not archived or disabled, and its default branch is master. We are not treating private: true in this empty status response as proof that the actual repository/artifact settings are private.

Local build and configuration

The new tag has the same Gradle build/publishing configuration, wrapper and GitHub workflow as the working 2.16.131 tag. A clean local Release AAR build, Release unit tests and lint succeed (174 tests, zero failures/errors, one skipped; no lint errors). The rebuilt AAR matches the existing GitHub Release asset byte for byte.

Because build.log itself returns 429, we cannot see or reproduce the exact JitPack build command from its log. No JitPack Gradle compilation failure has been observed. We have not deleted/recreated the tag or attempted a different release version.

Request

Could you check the backend logs using the above request timestamps/CF-Ray identifiers and confirm:

1. Whether the build job was accepted and why it remains Queued while the detail API reports none.
2. Which service/rule returns 429 for this new version, and whether this involves build admission/rate limiting, GitHub repository recognition/access, or scheduling.
3. Whether there is any actual artifact visibility restriction on this public project, and what action is needed to make 2.16.132 available.