Take the org-wide publication writer lock in every write-capable publisher job (Refs FS-GG/.github#4753)

.github/workflows/release-skills.yml

@@ -139,9 +139,9 @@ jobs:
           echo "artifact-digest=${{ steps.custody.outputs.artifact-digest }}"
 
   publish:
-    name: Pack & publish FS.GG.Game.Skills
+    name: Pack & publish FS.GG.Game.Skills [org-publication-writer]
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 50
     # Restrict to the canonical repo: fork tags/dispatch never run this (no fork secret exposure).
     if: github.repository == 'FS-GG/FS.GG.Game' && (github.event_name != 'workflow_dispatch' || inputs.readback_version == '')
     # Least-privilege: only this job gains packages: write, and the org-feed push uses the run-scoped
@@ -152,6 +152,11 @@ jobs:
       packages: write
       id-token: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 

.github/workflows/release-wasm.yml

@@ -65,17 +65,23 @@ jobs:
           bash tests/release/wasm/test-release-wasm.sh --source-only
 
   admission:
+    name: admission [org-publication-writer]
     needs: [preflight]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery' || inputs.mode == 'readback'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 45
     permissions:
       actions: read
       checks: read
       contents: write
       packages: write
       id-token: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
@@ -109,16 +115,22 @@ jobs:
           retention-days: 90
 
   begin:
+    name: begin [org-publication-writer]
     needs: [admission]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery'
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 75
     permissions:
       actions: read
       checks: read
       contents: write
       packages: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
@@ -149,16 +161,22 @@ jobs:
           retention-days: 90
 
   org:
+    name: org [org-publication-writer]
     needs: [begin]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery'
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 75
     permissions:
       actions: read
       checks: read
       contents: write
       packages: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
@@ -188,17 +206,23 @@ jobs:
           retention-days: 90
 
   public:
+    name: public [org-publication-writer]
     needs: [org]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery'
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 75
     permissions:
       actions: read
       checks: read
       contents: write
       packages: write
       id-token: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
@@ -233,16 +257,22 @@ jobs:
           retention-days: 90
 
   assets:
+    name: assets [org-publication-writer]
     needs: [public]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery'
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 75
     permissions:
       actions: read
       checks: read
       contents: write
       packages: read
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
@@ -272,16 +302,22 @@ jobs:
           retention-days: 90
 
   complete:
+    name: complete [org-publication-writer]
     needs: [org, public, assets]
     if: inputs.mode == 'promote' || inputs.mode == 'recovery'
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 75
     permissions:
       actions: read
       checks: read
       contents: write
       packages: read
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0

.github/workflows/release.yml

@@ -84,7 +84,7 @@ jobs:
         run: dotnet test FS.GG.Game.slnx -c Debug --no-restore
 
   publish-packages:
-    name: Publish FS.GG.Game.* (org feed + nuget.org, release-only)
+    name: Publish FS.GG.Game.* (org feed + nuget.org, release-only) [org-publication-writer]
     runs-on: ubuntu-latest
     if: github.repository == 'FS-GG/FS.GG.Game' && (github.event_name != 'release' || startsWith(github.event.release.tag_name, 'v')) && (github.event_name != 'workflow_dispatch' || inputs.admission_only != true)
     needs: [verify]
@@ -94,6 +94,11 @@ jobs:
       packages: write
       id-token: write   # ADR-0013: mint the GitHub OIDC token for nuget.org Trusted Publishing
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.version != '' && format('refs/tags/v{0}', inputs.version) || github.ref }}
@@ -339,15 +344,20 @@ jobs:
           retention-days: 90
 
   admission:
-    name: Observe registry and OIDC admission (no publication)
+    name: Observe registry and OIDC admission (no publication) [org-publication-writer]
     if: github.repository == 'FS-GG/FS.GG.Game' && github.event_name == 'workflow_dispatch' && inputs.admission_only == true
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 35
     permissions:
       contents: read
       packages: write # Match the publisher principal; this job makes only registry GET requests.
       id-token: write
     steps:
+      - name: Acquire org publication writer lock
+        uses: FS-GG/.github/.github/actions/publication-writer-lock@c799a9f9b21d52eb9766cf0950722e3e55145d39 # ADR-0097
+        with:
+          max-wait-minutes: 30
+        timeout-minutes: 32
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Guard isolated observation mode
         shell: bash