From f75b77e7aebc40b27c466ad74da06a3c946e1ed2 Mon Sep 17 00:00:00 2001
From: Stuart Kerr <sikerr@gmail.com>
Date: Tue, 6 Oct 2026 10:56:53 -0400
Subject: [PATCH] ci(release): poll the registry up to 8 min instead of
 checking once after 20s

v0.9.2 published fine via OIDC (provenance attached) but the run went red:
the verify step looked 20s after upload and npm serves a new version ~2-3 min
later. A successful release must not read as a failure.
---
 .github/workflows/release.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 276ed76..eae4cb1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,12 +71,18 @@ jobs:
       - run: npm publish --access public
 
       - name: Verify the registry serves it
+        # npm reports "+ pkg@x.y.z" the moment the upload is accepted but the registry takes a few minutes
+        # to serve it (measured 2026-10-06: ~3 min for 0.9.1 by hand, ~2 min for 0.9.2 from CI). A single
+        # check 20s later turned a SUCCESSFUL publish into a red run. Poll for up to 8 minutes instead.
         run: |
-          sleep 20
-          LIVE="$(npm view explainmyrepo version)"
           PKG_V="$(node -p "require('./package.json').version")"
-          if [ "$LIVE" != "$PKG_V" ]; then
-            echo "::error::registry serves $LIVE, expected $PKG_V"
-            exit 1
-          fi
-          echo "explainmyrepo@$LIVE is live."
+          for i in $(seq 1 32); do
+            LIVE="$(npm view explainmyrepo version)"
+            if [ "$LIVE" = "$PKG_V" ]; then
+              echo "explainmyrepo@$LIVE is live."
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "::error::registry still serves $LIVE after 8 min, expected $PKG_V"
+          exit 1