From a8df0c9593a5e66561704dd82b905f557f3e427b Mon Sep 17 00:00:00 2001
From: Brandon Corbett <Bccorb@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:00:21 -0400
Subject: [PATCH] ci: harden the release workflow against a single flaky target

The last release (v1.1.0) was cancelled on the x86_64-apple-darwin build and,
because the Release, Homebrew, and crates jobs all wait on the build matrix,
every one was skipped. No GitHub Release was created, the Homebrew formula
stayed at 1.0.0, and nothing reached crates.io.

Build x86_64 macOS by cross-compiling on the arm64 runner and retire the
macos-13 Intel runner, which GitHub is deprecating and which is where the last
release stalled. The cross-build was verified locally to produce an x86_64
binary with aws-lc-sys and ring compiled in.

Decouple the crates.io publish from the binary matrix: it only needs the
source, so a flaky binary runner no longer skips it, which is part of why the
crate has never shipped.

Fail the release loudly if the matrix did not produce all six binaries, so a
missing platform cannot slip into a published release or leave the Homebrew
formula pointing at a binary that was never uploaded. Add build and job
timeouts so a hung runner fails instead of lingering until cancelled.
---
 .github/workflows/release.yml | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 00f7cd3..562a717 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -39,12 +39,22 @@ jobs:
   build:
     name: Build ${{ matrix.target }}
     needs: setup
+    # A cold build of this dependency tree runs long; the cap only trips a hung
+    # runner, which is what left the previous release stuck mid-matrix.
+    timeout-minutes: 45
     strategy:
+      # Let every target finish rather than cancelling siblings on the first
+      # failure, so one run surfaces all the failures and re-running failed jobs
+      # can complete the set. The release still requires all six binaries.
       fail-fast: false
       matrix:
         include:
+          # x86_64 macOS cross-compiles on the arm64 runner. Its own Intel
+          # runner (macos-13) is being retired, and a build there cancelled the
+          # last release; the cross-build is verified to produce an x86_64
+          # binary, aws-lc-sys and ring included.
           - { target: aarch64-apple-darwin,       os: macos-14,        profile: release }
-          - { target: x86_64-apple-darwin,        os: macos-13,        profile: release }
+          - { target: x86_64-apple-darwin,        os: macos-14,        profile: release }
           - { target: x86_64-unknown-linux-gnu,   os: ubuntu-latest,   profile: release-linux }
           - { target: aarch64-unknown-linux-gnu,  os: ubuntu-24.04-arm, profile: release-linux }
           - { target: x86_64-unknown-linux-musl,  os: ubuntu-latest,   profile: release-linux, musl: true }
@@ -91,6 +101,7 @@ jobs:
     name: Publish GitHub Release + Homebrew
     needs: [setup, build]
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
         with:
@@ -105,6 +116,18 @@ jobs:
         run: |
           mkdir -p dist
           find artifacts -type f -exec cp {} dist/ \;
+
+          # Fail loudly on a missing platform rather than publishing a release
+          # that silently omits one, and rather than letting the Homebrew
+          # formula point at a binary that was never uploaded.
+          expected=6
+          found=$(find dist -type f -name 'seamless-glance-*' | wc -l | tr -d ' ')
+          if [[ "$found" -ne "$expected" ]]; then
+            echo "::error::expected $expected platform binaries, found $found"
+            ls -l dist
+            exit 1
+          fi
+
           (cd dist && sha256sum seamless-glance-* > SHA256SUMS.txt)
           ls -l dist
 
@@ -148,10 +171,15 @@ jobs:
 
   crates:
     name: Publish to crates.io
-    needs: [setup, build]
+    # Source-only, so it does not wait on the binary matrix. Gating it on the
+    # builds meant a single flaky binary runner skipped the crates.io publish
+    # entirely, which is part of why the crate has never shipped.
+    needs: [setup]
     runs-on: ubuntu-latest
+    timeout-minutes: 25
     # A missing token, taken crate name, or already-published version should not
-    # fail the binary release.
+    # fail the release. cargo publish still compiles the crate first, so it will
+    # not push code that does not build.
     continue-on-error: true
     steps:
       - uses: actions/checkout@v4