From feba5d03a3e34f6eb872feec9434f8ccfd162ec5 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Wed, 7 Oct 2026 18:31:02 -0700 Subject: [PATCH 1/3] Wait up to 5.5 hours for reviewer-approved publishes before the GitHub Release --- .github/workflows/release-github.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 7874ca4..12b1c9a 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -19,6 +19,7 @@ jobs: name: Wait for SDK publishes if: github.event_name == 'push' runs-on: ubuntu-latest + timeout-minutes: 340 permissions: actions: read steps: @@ -28,7 +29,7 @@ jobs: run: | WORKFLOWS=("release-go.yml" "release-typescript.yml" "release-ruby.yml" "release-swift.yml" "release-kotlin.yml" "release-rust.yml") TAG="${GITHUB_REF#refs/tags/}" - MAX_WAIT=1800 # 30 minutes + MAX_WAIT=19800 # 5.5 hours: each publish now waits for a reviewer's approval POLL=30 ELAPSED=0 From 0605cbc82a9a45ce22198d494c96e8bbf231aab2 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 19 Oct 2026 22:50:14 -0700 Subject: [PATCH 2/3] Poll every publish with one request, so a long approval wait stays inside the token's quota Six filename-based gh run list calls every 30s cost ~1,440 requests an hour against GITHUB_TOKEN's 1,000, ending the wait at ~40 minutes. List the commit's runs once per poll and match each workflow by path, and let a transient listing error retry next poll instead of ending the job. --- .github/workflows/release-github.yml | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 12b1c9a..8831c43 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -38,16 +38,23 @@ jobs: ANY_FAILED=false STATUS_LINE="" + # One request per poll for every run on this commit: a per-workflow + # `gh run list --workflow` costs two requests each, and six of them + # every 30s outruns GITHUB_TOKEN's 1,000 requests/hour well inside + # the approval wait. + RUNS_JSON=$(gh api \ + "repos/$GITHUB_REPOSITORY/actions/runs?head_sha=$GITHUB_SHA&event=push&per_page=100" \ + --jq '.workflow_runs') || { + # A transient API error shouldn't end a wait measured in hours + echo "::warning::Listing workflow runs failed; retrying next poll" + RUNS_JSON='[]' + } + for WF in "${WORKFLOWS[@]}"; do - # Fetch recent runs and find the one matching this tag push - RUN_JSON=$(gh run list \ - --repo "$GITHUB_REPOSITORY" \ - --workflow "$WF" \ - --branch "$TAG" \ - --event push \ - --limit 5 \ - --json conclusion,headSha \ - --jq "[.[] | select(.headSha == \"$GITHUB_SHA\")] | .[0] // empty") + # Newest run of this workflow for this tag push + RUN_JSON=$(echo "$RUNS_JSON" | jq -c \ + --arg path ".github/workflows/$WF" --arg tag "$TAG" \ + '[.[] | select(.path == $path and .head_branch == $tag)] | .[0] // empty') if [ -z "$RUN_JSON" ]; then ALL_DONE=false From 8896f5e680ae13ae612a4b68918b72630a1bad98 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Mon, 19 Oct 2026 23:04:52 -0700 Subject: [PATCH 3/3] Match a run's workflow path with or without its ref suffix GitHub documents workflow_runs[].path as possibly ref-qualified (.github/workflows/build.yml@main); strip it before comparing. --- .github/workflows/release-github.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-github.yml b/.github/workflows/release-github.yml index 8831c43..c7a8943 100644 --- a/.github/workflows/release-github.yml +++ b/.github/workflows/release-github.yml @@ -54,7 +54,7 @@ jobs: # Newest run of this workflow for this tag push RUN_JSON=$(echo "$RUNS_JSON" | jq -c \ --arg path ".github/workflows/$WF" --arg tag "$TAG" \ - '[.[] | select(.path == $path and .head_branch == $tag)] | .[0] // empty') + '[.[] | select((.path | sub("@.*$"; "")) == $path and .head_branch == $tag)] | .[0] // empty') if [ -z "$RUN_JSON" ]; then ALL_DONE=false