From 64343d6de6b5949bac250874d51eacc50c324a9a Mon Sep 17 00:00:00 2001
From: Artemis MUCAJ <artemis.mucaj@netatmo.com>
Date: Tue, 4 Aug 2026 23:41:45 +0200
Subject: [PATCH] ci: retry notarization on transient poll failures

Apple's notary status endpoint occasionally drops the polling connection
(-1009), which killed notarytool --wait mid-submission. Retry the whole
submit-and-wait up to 3 times and bound each attempt with --timeout 30m so a
transient network blip doesn't fail an otherwise-successful release.
---
 .github/workflows/release.yml | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 91c5bd5..71797b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,13 +94,26 @@ jobs:
 
           echo "$NOTARY_KEY_P8" | base64 --decode > "$RUNNER_TEMP/notary.p8"
           ditto -c -k "${{ matrix.asset_name }}" "$RUNNER_TEMP/notarize.zip"
-          xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
-            --key "$RUNNER_TEMP/notary.p8" \
-            --key-id "$NOTARY_KEY_ID" \
-            --issuer "$NOTARY_ISSUER_ID" \
-            --wait
+          # Apple's notary service can be slow and its status endpoint
+          # occasionally drops the polling connection (-1009), which kills
+          # --wait. Retry the whole submit-and-wait so a transient blip doesn't
+          # fail the release; --timeout bounds each attempt.
+          notarized=false
+          for attempt in 1 2 3; do
+            if xcrun notarytool submit "$RUNNER_TEMP/notarize.zip" \
+              --key "$RUNNER_TEMP/notary.p8" \
+              --key-id "$NOTARY_KEY_ID" \
+              --issuer "$NOTARY_ISSUER_ID" \
+              --wait --timeout 30m; then
+              notarized=true
+              break
+            fi
+            echo "notarize attempt $attempt failed; retrying in 30s"
+            sleep 30
+          done
           rm -f "$RUNNER_TEMP/notary.p8" "$RUNNER_TEMP/notarize.zip"
           security delete-keychain "$KEYCHAIN" 2>/dev/null || true
+          [ "$notarized" = true ] || { echo "notarization failed after retries"; exit 1; }
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4