fix(release): bound notarytool --wait so a stuck submission can't eat the whole CI budget#9
Merged
Merged
Conversation
… the whole CI budget A wedged notary submission left `notarytool submit --wait` polling with no ceiling, so the Release job idled to GitHub's hard 6-hour limit and was killed mid-notarize (its submission survived on Apple's side, but the run produced nothing). Cap the poll at 30m — Apple keeps processing server-side regardless — and add a 60m job backstop so a stuck step fails loudly instead of consuming the full runner budget. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
The first real Release run (
28793472488, tagv0.1.0) ran 6h 0m 27s and was killed at GitHub's hard 6-hour job timeout — not a manual cancel. The last log line isTerminate orphan process: pid (7447) (notarytool): the job was blocked insidenotarytool submit --waitthe entire time and produced no artifacts.Notarization happens server-side on Apple's notary service (
notarytool --help: "The Notary service will continue processing even if the timeout is reached"), so the submission itself wasn't lost — but--waithad no ceiling, so a submission that wedgedIn Progressidled the runner to its hard limit.Fix
Scripts/release/notarize.sh— add--timeout 30mtonotarytool submit --wait. A healthy submission clears in minutes; if Apple wedges one, notarytool now exits non-zero at 30m so the release fails loudly instead of hanging..github/workflows/release.yml— addtimeout-minutes: 60on thereleasejob as a backstop for any other step, so nothing can idle to the 6-hour ceiling again.Verification
make check— ✅ (swift-format lint, architecture boundaries, license headers)bash -n Scripts/release/notarize.sh— ✅timeout-minutes: 60at job scope--timeout 30mconfirmed valid againstxcrun notarytool submit --help(suffixm= minutes)After merge
Re-point tag
v0.1.0at the squash-merge commit onmainand force-push it to trigger a fresh Release run.🤖 Generated with Claude Code