From 92a52f09929e78305b0962387638049b1c0ab9d2 Mon Sep 17 00:00:00 2001 From: Harshit Singh Bhandari Date: Mon, 29 Jun 2026 03:58:19 +0530 Subject: [PATCH] ci: retry transient macOS sign/notary flakes in the publish step (#2266) Releases fail intermittently on transient macOS issues that hit EITHER macOS leg, not just Intel: Apple notary -1009 connection-offline (seen on macos-latest/arm64) and osx-sign keychain races, code object is not signed at all (seen on macos-15-intel). Both pass on a manual re-run. Wrap npm run publish in a 3x retry with backoff in all four release/nightly publish steps so these self-heal in-place instead of failing the run (and, for nightly, skipping the whole feed). Keeps the Intel leg coupled so the x64 feed entry stays guaranteed. Co-authored-by: Claude Opus 4.8 --- .github/workflows/frontend-nightly.yml | 22 ++++++++++++++++++++-- .github/workflows/frontend-release.yml | 22 ++++++++++++++++++++-- 2 files changed, 40 insertions(+), 4 deletions(-) diff --git a/.github/workflows/frontend-nightly.yml b/.github/workflows/frontend-nightly.yml index ec3c400ab..b56de27d1 100644 --- a/.github/workflows/frontend-nightly.yml +++ b/.github/workflows/frontend-nightly.yml @@ -85,7 +85,16 @@ jobs: apple-api-issuer: ${{ secrets.APPLE_API_ISSUER }} apple-signing-identity: ${{ secrets.APPLE_SIGNING_IDENTITY }} - name: Publish - run: npm run publish + run: | + # Retry transient macOS sign/notary flakes (Apple notary -1009, + # osx-sign keychain races) so the build self-heals instead of failing. + for i in 1 2 3; do + if npm run publish; then exit 0; fi + echo "::warning::publish attempt $i/3 failed (likely a transient macOS sign/notary flake)" + [ "$i" -lt 3 ] && sleep 30 + done + echo "::error::publish failed after 3 attempts" >&2 + exit 1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} AO_RELEASE_REPO: ${{ github.repository }} @@ -135,7 +144,16 @@ jobs: apple-api-issuer: ${{ secrets.APPLE_API_ISSUER }} apple-signing-identity: ${{ secrets.APPLE_SIGNING_IDENTITY }} - name: Publish - run: npm run publish + run: | + # Retry transient macOS sign/notary flakes (Apple notary -1009, + # osx-sign keychain races) so the build self-heals instead of failing. + for i in 1 2 3; do + if npm run publish; then exit 0; fi + echo "::warning::publish attempt $i/3 failed (likely a transient macOS sign/notary flake)" + [ "$i" -lt 3 ] && sleep 30 + done + echo "::error::publish failed after 3 attempts" >&2 + exit 1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} AO_RELEASE_REPO: ${{ github.repository }} diff --git a/.github/workflows/frontend-release.yml b/.github/workflows/frontend-release.yml index 06af8c680..ccec8e3cb 100644 --- a/.github/workflows/frontend-release.yml +++ b/.github/workflows/frontend-release.yml @@ -76,7 +76,16 @@ jobs: apple-api-issuer: ${{ secrets.APPLE_API_ISSUER }} apple-signing-identity: ${{ secrets.APPLE_SIGNING_IDENTITY }} - name: Publish - run: npm run publish + run: | + # Retry transient macOS sign/notary flakes (Apple notary -1009, + # osx-sign keychain races) so the build self-heals instead of failing. + for i in 1 2 3; do + if npm run publish; then exit 0; fi + echo "::warning::publish attempt $i/3 failed (likely a transient macOS sign/notary flake)" + [ "$i" -lt 3 ] && sleep 30 + done + echo "::error::publish failed after 3 attempts" >&2 + exit 1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} AO_RELEASE_REPO: ${{ github.repository }} @@ -191,7 +200,16 @@ jobs: apple-api-issuer: ${{ secrets.APPLE_API_ISSUER }} apple-signing-identity: ${{ secrets.APPLE_SIGNING_IDENTITY }} - name: Publish - run: npm run publish + run: | + # Retry transient macOS sign/notary flakes (Apple notary -1009, + # osx-sign keychain races) so the build self-heals instead of failing. + for i in 1 2 3; do + if npm run publish; then exit 0; fi + echo "::warning::publish attempt $i/3 failed (likely a transient macOS sign/notary flake)" + [ "$i" -lt 3 ] && sleep 30 + done + echo "::error::publish failed after 3 attempts" >&2 + exit 1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} AO_RELEASE_REPO: ${{ github.repository }}