Wait up to 5.5 hours for reviewer-approved publishes before the GitHub Release

Merged
JE
7d ago
+18-10

release-github now waits up to 5.5 hours for the registry publishes, instead of 30 minutes, because each publish now waits for a reviewer.

Why: every registry publish (RubyGems, npm, crates, GitHub Packages and the Go module tag) runs in its own environment, and those environments now require approval from sip or cli. A 30-minute wait would fail the GitHub Release before reviewers got to them.

Releasing now: push the v* tag as before. Each language's workflow then waits at its publish job:

  • 5 approvals per release, one per workflow run: rubygems, npm, crates, github-packages (Kotlin) and go. Swift publishes nothing gated; SwiftPM reads the tag.
  • Each publish job waits only on its own build, so every one is ready for approval as soon as its build passes.
  • The Go module tag is pushed only after approval.
  • release-github needs no approval of its own. It creates the notes-only GitHub Release once every publish run for the tag has succeeded. A rejected or unanswered publish fails it. If approvals take longer than 5.5 hours, re-run it with gh workflow run release-github.yml -f tag=vX.Y.Z.

Who approves: a member of sip or cli. Prevent-self-review is on, so whoever pushed the tag can't approve their own release; another member does.

To approve every waiting run for a tag in one pass (GitHub still records one approval per run):

R=basecamp/fizzy-sdk TAG=vX.Y.Z
gh api repos/$R/compare/main...$TAG --jq .status    # behind or identical: the tag is on main
for id in $(gh run list -R $R --branch "$TAG" --event push --status waiting --json databaseId --jq '.[].databaseId'); do
  ids=$(gh api repos/$R/actions/runs/$id/pending_deployments --jq '[.[]|select(.current_user_can_approve)|.environment.id]')
  [ "$ids" = "[]" ] || gh api -X POST repos/$R/actions/runs/$id/pending_deployments --input - <<<"{\"environment_ids\":$ids,\"state\":\"approved\",\"comment\":\"$TAG\"}" >/dev/null
done

Run it again if a build finishes after the first pass.

Environment: all five environments already exist, require sip or cli, and admit only v* tags. Nothing else needs configuring when this merges.

Merging is the owners' call.

Summary by cubic

Updates the release-github workflow to wait up to 5.5 hours for reviewer-approved registry publishes before creating the GitHub Release, instead of 30 minutes. Each registry publish (RubyGems, npm, crates, GitHub Packages, and the Go module tag) now requires an approval from a sip or cli member, so the old timeout was too short. If approvals take longer than 5.5 hours, rerun the workflow with the tag.

The wait now lists each commit's runs with one API request per poll instead of six, keeping it inside GITHUB_TOKEN's 1,000 requests/hour quota; a transient listing error retries on the next poll instead of ending the job. Workflow runs are matched by path whether it carries a ref suffix or not.