Skip to content

ci: retry notarization on transient poll failures - #212

Merged
ArtemisMucaj merged 1 commit into
mainfrom
ci/harden-notarize-retry
Aug 4, 2026
Merged

ci: retry notarization on transient poll failures#212
ArtemisMucaj merged 1 commit into
mainfrom
ci/harden-notarize-retry

Conversation

@ArtemisMucaj

@ArtemisMucaj ArtemisMucaj commented Aug 4, 2026

Copy link
Copy Markdown
Owner

Apple's notary status endpoint occasionally drops the polling connection (-1009), which killed notarytool --wait mid-submission (this failed panoply's v0.1.1 release build after Apple had already accepted the submission). Retries the whole submit-and-wait up to 3× with --timeout 30m per attempt so a transient blip doesn't fail an otherwise-successful release.

Summary by CodeRabbit

  • Bug Fixes
    • Improved macOS release notarization reliability with automatic retries.
    • Releases now clearly fail when notarization remains unsuccessful after all attempts.
    • Cleanup of temporary signing resources continues after failures.

Apple's notary status endpoint occasionally drops the polling connection
(-1009), which killed notarytool --wait mid-submission. Retry the whole
submit-and-wait up to 3 times and bound each attempt with --timeout 30m so a
transient network blip doesn't fail an otherwise-successful release.
@ArtemisMucaj
ArtemisMucaj merged commit 9ee3b54 into main Aug 4, 2026
@ArtemisMucaj
ArtemisMucaj deleted the ci/harden-notarize-retry branch August 4, 2026 21:44
@coderabbitai

coderabbitai Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c4c8a68-77f3-4de2-b913-8f828ae4af48

📥 Commits

Reviewing files that changed from the base of the PR and between 289a23a and 64343d6.

📒 Files selected for processing (1)
  • .github/workflows/release.yml

📝 Walkthrough

Walkthrough

The macOS release workflow now retries notarization up to three times. Each attempt has a 30-minute timeout and failed attempts wait 30 seconds before retrying. The workflow fails after cleanup if no attempt succeeds.

Changes

macOS notarization retry handling

Layer / File(s) Summary
Bounded notarization attempts
.github/workflows/release.yml
The workflow replaces the unbounded submission with three timed attempts, logs failures, delays retries, tracks success, and exits with failure when notarization does not succeed. Cleanup remains in place.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Possibly related PRs

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/harden-notarize-retry

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant