[jeremy]

release-github now waits up to 5.5 hours for the registry publishes, instead of 30 minutes, because each publish now waits for a reviewer.

Why: every registry publish (RubyGems, npm, crates, GitHub Packages and the Go module tag) runs in its own environment, and those environments now require approval from sip or cli. A 30-minute wait would fail the GitHub Release before reviewers got to them.

Releasing now: push the v* tag as before. Each language's workflow then waits at its publish job:

• 5 approvals per release, one per workflow run: rubygems, npm, crates, github-packages (Kotlin) and go. Swift publishes nothing gated; SwiftPM reads the tag.
• Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
• The Go module tag is pushed only after approval.
• release-github needs no approval of its own. It creates the notes-only GitHub Release once every publish run for the tag has succeeded. A rejected or unanswered publish fails it. If approvals take longer than 5.5 hours, re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z.

Who approves: a member of sip or cli. Prevent-self-review is on, so whoever pushed the tag can't approve their own release; another member does.

To approve every waiting run for a tag in one pass (GitHub still records one approval per run):

R=basecamp/fizzy-sdk TAG=vX.Y.Z
gh api repos/$R/compare/main...$TAG --jq .status    # behind or identical: the tag is on main
for id in $(gh run list -R $R --branch "$TAG" --event push --status waiting --json databaseId --jq '.[].databaseId'); do
  ids=$(gh api repos/$R/actions/runs/$id/pending_deployments --jq '[.[]|select(.current_user_can_approve)|.environment.id]')
  [ "$ids" = "[]" ] || gh api -X POST repos/$R/actions/runs/$id/pending_deployments --input - <<<"{\"environment_ids\":$ids,\"state\":\"approved\",\"comment\":\"$TAG\"}" >/dev/null
done

Run it again if a build finishes after the first pass.

Environment: all five environments already exist, require sip or cli, and admit only v* tags. Nothing else needs configuring when this merges.

Merging is the owners' call.

---

Summary by cubic

Updates the release-github workflow to wait up to 5.5 hours for reviewer-approved registry publishes before creating the GitHub Release, instead of 30 minutes. Each registry publish (RubyGems, npm, crates, GitHub Packages, and the Go module tag) now requires an approval from a sip or cli member, so the old timeout was too short. If approvals take longer than 5.5 hours, rerun the workflow with the tag.

The wait now lists each commit's runs with one API request per poll instead of six, keeping it inside GITHUB_TOKEN's 1,000 requests/hour quota; a transient listing error retries on the next poll instead of ending the job. Workflow runs are matched by path whether it carries a ref suffix or not.

^{Written for commit 8896f5e. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T06:09:06.475640Z	8896f5e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cubic-dev-ai]

No issues found across 1 file

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df059d2ada

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremy]

Release secrets and the per-registry environments

This repository publishes from one environment per registry:

• release-rubygems
• release-npm
• release-crates
• release-github-packages
• release-go

No secret needs to move into them, so there is nothing to rotate in here. Each publish authenticates with OIDC trusted publishing (the package registries) or GITHUB_TOKEN (the Go module tag and GitHub Packages), and the repository has no Actions secrets.

If a registry ever needs a token, put it in that registry's environment, not at repository level, and use the same order the other repositories follow:

1. Issue a fresh token.
2. Set it directly in the environment: gh secret set NAME --repo basecamp/fizzy-sdk --env release-<registry>
3. Run, or wait for, one release under that environment and confirm it succeeds.
4. Only then delete any repository-level copy and revoke the old token.

Each registry's trusted publisher should also name its environment (for example release-rubygems), so a publish from outside it is refused.

[jeremy]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0605cbc82a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 8896f5e680

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".