From 249f57172228233b8f9d5c8d643c48e080962442 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Martin=20Ad=C3=A1mek?= Date: Fri, 6 Nov 2026 14:49:04 -0800 Subject: [PATCH] ci: make npm publish survive slow Rekor (sigstore 409 + 30s timeout) Ports apify/crawlee#4323: patch sigstore@5.0.0 to fetch the existing Rekor entry on 409 and use a 30s timeout, and retry the publish step 5x with 60s waits. --- .github/workflows/publish_to_npm.yaml | 9 ++++++++- patches/sigstore@5.0.0.patch | 22 ++++++++++++++++++++++ pnpm-lock.yaml | 11 ++++++++--- pnpm-workspace.yaml | 3 +++ 4 files changed, 41 insertions(+), 4 deletions(-) create mode 100644 patches/sigstore@5.0.0.patch diff --git a/.github/workflows/publish_to_npm.yaml b/.github/workflows/publish_to_npm.yaml index a9b9ac29..fbfe6cbc 100644 --- a/.github/workflows/publish_to_npm.yaml +++ b/.github/workflows/publish_to_npm.yaml @@ -158,6 +158,13 @@ jobs: GH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }} TAGS: ${{ steps.version_packages.outputs.tags }} + # Rekor outages last minutes; the sigstore patch (30s Rekor timeout + fetch the existing entry on 409) covers the per-call side. + # Retrying is safe because `from-package` skips versions that already made it to npm. - name: Publish to NPM if: ${{ steps.changed.outputs.count != '0' }} - run: pnpm exec lerna publish from-package --contents dist --yes ${{ inputs.prerelease && '--dist-tag next' || '' }} + uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0 + with: + timeout_minutes: 10 + max_attempts: 5 + retry_wait_seconds: 60 + command: pnpm exec lerna publish from-package --contents dist --yes ${{ inputs.prerelease && '--dist-tag next' || '' }} diff --git a/patches/sigstore@5.0.0.patch b/patches/sigstore@5.0.0.patch new file mode 100644 index 00000000..f5a8b27d --- /dev/null +++ b/patches/sigstore@5.0.0.patch @@ -0,0 +1,22 @@ +diff --git a/dist/config.js b/dist/config.js +index 373149fe22fb750faeefba5d20a0e432bb91df14..000fbba94c277639c264740599560382f8706399 100644 +--- a/dist/config.js ++++ b/dist/config.js +@@ -23,7 +23,7 @@ const core_1 = require("@sigstore/core"); + const sign_1 = require("@sigstore/sign"); + const verify_1 = require("@sigstore/verify"); + exports.DEFAULT_RETRY = { retries: 2 }; +-exports.DEFAULT_TIMEOUT = 5000; ++exports.DEFAULT_TIMEOUT = 30000; + function createBundleBuilder(bundleType, options) { + const bundlerOptions = { + signer: initSigner(options), +@@ -102,7 +102,7 @@ function initWitnesses(options) { + witnesses.push(new sign_1.RekorWitness({ + rekorBaseURL: options.rekorURL, + entryType: options.legacyCompatibility ? 'intoto' : 'dsse', +- fetchOnConflict: false, ++ fetchOnConflict: true, + retry: options.retry ?? exports.DEFAULT_RETRY, + timeout: options.timeout ?? exports.DEFAULT_TIMEOUT, + })); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a0cd6044..487de3e0 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,6 +7,11 @@ settings: overrides: esbuild: ^0.28.1 +patchedDependencies: + sigstore@5.0.0: + hash: 94d1d48cacdbd6a05f183c4d779c907731d3138f3a29530331b721a2963baf17 + path: patches/sigstore@5.0.0.patch + importers: .: @@ -4828,7 +4833,7 @@ snapshots: npm-registry-fetch: 20.0.1 proc-log: 7.0.0 semver: 7.8.5 - sigstore: 5.0.0 + sigstore: 5.0.0(patch_hash=94d1d48cacdbd6a05f183c4d779c907731d3138f3a29530331b721a2963baf17) ssri: 14.0.0 transitivePeerDependencies: - kerberos @@ -5323,7 +5328,7 @@ snapshots: npm-pick-manifest: 12.0.0 npm-registry-fetch: 20.0.1 proc-log: 7.0.0 - sigstore: 5.0.0 + sigstore: 5.0.0(patch_hash=94d1d48cacdbd6a05f183c4d779c907731d3138f3a29530331b721a2963baf17) ssri: 14.0.0 tar: 7.5.22 transitivePeerDependencies: @@ -5498,7 +5503,7 @@ snapshots: signal-exit@4.1.0: {} - sigstore@5.0.0: + sigstore@5.0.0(patch_hash=94d1d48cacdbd6a05f183c4d779c907731d3138f3a29530331b721a2963baf17): dependencies: '@sigstore/bundle': 5.0.0 '@sigstore/core': 4.0.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 4a4c28c4..12db1f70 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -14,3 +14,6 @@ minimumReleaseAgeExclude: - "got-scraping" nodeLinker: hoisted + +patchedDependencies: + sigstore@5.0.0: patches/sigstore@5.0.0.patch