ci: make npm publish survive slow Rekor (sigstore 409 + 30s timeout)

.github/workflows/publish_to_npm.yaml

@@ -158,6 +158,13 @@ jobs:
                   GH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
                   TAGS: ${{ steps.version_packages.outputs.tags }}
 
+            # Rekor outages last minutes; the sigstore patch (30s Rekor timeout + fetch the existing entry on 409) covers the per-call side.
+            # Retrying is safe because `from-package` skips versions that already made it to npm.
             - name: Publish to NPM
               if: ${{ steps.changed.outputs.count != '0' }}
-              run: pnpm exec lerna publish from-package --contents dist --yes ${{ inputs.prerelease && '--dist-tag next' || '' }}
+              uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
+              with:
+                  timeout_minutes: 10
+                  max_attempts: 5
+                  retry_wait_seconds: 60
+                  command: pnpm exec lerna publish from-package --contents dist --yes ${{ inputs.prerelease && '--dist-tag next' || '' }}

patches/sigstore@5.0.0.patch

@@ -0,0 +1,22 @@
+diff --git a/dist/config.js b/dist/config.js
+index 373149fe22fb750faeefba5d20a0e432bb91df14..000fbba94c277639c264740599560382f8706399 100644
+--- a/dist/config.js
++++ b/dist/config.js
+@@ -23,7 +23,7 @@ const core_1 = require("@sigstore/core");
+ const sign_1 = require("@sigstore/sign");
+ const verify_1 = require("@sigstore/verify");
+ exports.DEFAULT_RETRY = { retries: 2 };
+-exports.DEFAULT_TIMEOUT = 5000;
++exports.DEFAULT_TIMEOUT = 30000;
+ function createBundleBuilder(bundleType, options) {
+     const bundlerOptions = {
+         signer: initSigner(options),
+@@ -102,7 +102,7 @@ function initWitnesses(options) {
+         witnesses.push(new sign_1.RekorWitness({
+             rekorBaseURL: options.rekorURL,
+             entryType: options.legacyCompatibility ? 'intoto' : 'dsse',
+-            fetchOnConflict: false,
++            fetchOnConflict: true,
+             retry: options.retry ?? exports.DEFAULT_RETRY,
+             timeout: options.timeout ?? exports.DEFAULT_TIMEOUT,
+         }));

pnpm-workspace.yaml

@@ -14,3 +14,6 @@ minimumReleaseAgeExclude:
   - "got-scraping"
 
 nodeLinker: hoisted
+
+patchedDependencies:
+  [email protected]: patches/[email protected]