From 3578c72d54fb81d8ab5c43c72451d2200a27c7f0 Mon Sep 17 00:00:00 2001 From: EHotwagner Date: Sat, 24 Oct 2026 20:21:35 +0200 Subject: [PATCH] Take the org-wide publication writer lock in every write-capable publisher job (Refs FS-GG/.github#4753) ADR-0097 (FS-GG/.github#4858, c799a9f9): GitHub concurrency groups are per repository, so all FS-GG publishers serialize through one ticketed lock over the public Actions job list. Each write-capable job here gets the pinned lock step first, a job name carrying [org-publication-writer], and its timeout raised by exactly the bounded wait so its own working budget is unchanged. Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/release-skills.yml | 7 ++++++- .github/workflows/release.yml | 14 ++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-skills.yml b/.github/workflows/release-skills.yml index 241811f..ff746d8 100644 --- a/.github/workflows/release-skills.yml +++ b/.github/workflows/release-skills.yml @@ -19,13 +19,18 @@ concurrency: jobs: publish: - name: Publish FS.GG.Audio.Skills + name: Publish FS.GG.Audio.Skills [org-publication-writer] runs-on: ubuntu-latest permissions: contents: read packages: write id-token: write steps: + - name: Acquire org publication writer lock + uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097 + with: + max-wait-minutes: 30 + timeout-minutes: 32 - uses: actions/checkout@v7 - uses: actions/setup-dotnet@v6 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 639df2d..125063b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -53,7 +53,7 @@ permissions: jobs: recover-skills: - name: Recover FS.GG.Audio.Skills from the org feed + name: Recover FS.GG.Audio.Skills from the org feed [org-publication-writer] runs-on: ubuntu-latest if: github.repository == 'FS-GG/FS.GG.Audio' && github.event_name == 'workflow_dispatch' && inputs.skills_version != '' permissions: @@ -62,6 +62,11 @@ jobs: packages: read id-token: write steps: + - name: Acquire org publication writer lock + uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097 + with: + max-wait-minutes: 30 + timeout-minutes: 32 - uses: actions/checkout@v7 - uses: actions/setup-dotnet@v6 with: @@ -223,7 +228,7 @@ jobs: - uses: ./.github/actions/headless-test publish: - name: Publish packages (org feed + nuget.org) + schema/apps assets + name: Publish packages (org feed + nuget.org) + schema/apps assets [org-publication-writer] runs-on: ubuntu-latest if: github.repository == 'FS-GG/FS.GG.Audio' && (github.event_name != 'workflow_dispatch' || inputs.skills_version == '') needs: [verify] @@ -233,6 +238,11 @@ jobs: packages: write # push to the org GitHub Packages feed id-token: write # ADR-0013: mint the GitHub OIDC token for nuget.org Trusted Publishing steps: + - name: Acquire org publication writer lock + uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097 + with: + max-wait-minutes: 30 + timeout-minutes: 32 - uses: actions/checkout@v7 with: ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version != '' && format('refs/tags/v{0}', inputs.version) || github.ref }}