From 0b97c0ac290bc06596bb50a918ae31b8e06d627d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bar=C4=B1=C5=9Fcan=20Aslan?= Date: Tue, 7 Jul 2026 17:10:56 +0300 Subject: [PATCH] fix(release): bound notarytool --wait so a stuck submission can't eat the whole CI budget MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A wedged notary submission left `notarytool submit --wait` polling with no ceiling, so the Release job idled to GitHub's hard 6-hour limit and was killed mid-notarize (its submission survived on Apple's side, but the run produced nothing). Cap the poll at 30m — Apple keeps processing server-side regardless — and add a 60m job backstop so a stuck step fails loudly instead of consuming the full runner budget. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 3 +++ Scripts/release/notarize.sh | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5c43ece..6b741fc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,9 @@ jobs: release: name: Sign, notarize & publish runs-on: macos-26 + # Backstop the per-step notarytool --timeout: if any step wedges, fail at ~1h rather than + # letting the run idle to GitHub's 6-hour hard limit (which a stuck notarization once did). + timeout-minutes: 60 env: DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer TEAM_ID: ${{ secrets.APPLE_TEAM_ID }} diff --git a/Scripts/release/notarize.sh b/Scripts/release/notarize.sh index c565955..e7faf4d 100755 --- a/Scripts/release/notarize.sh +++ b/Scripts/release/notarize.sh @@ -26,9 +26,14 @@ log "Zipping app for notarization → $SUBMIT_ZIP" run ditto -c -k --keepParent "$APP" "$SUBMIT_ZIP" log "Submitting to the notary service (this can take a few minutes)…" +# --timeout bounds the --wait poll. A healthy submission clears in minutes, but Apple's notary +# service can occasionally wedge a submission "In Progress" indefinitely; without a bound, --wait +# blocks until the CI job itself is killed (a stuck run once burned GitHub's full 6-hour budget). +# Fail fast at 30m so the release errors loudly instead of idling to the runner's hard ceiling. run xcrun notarytool submit "$SUBMIT_ZIP" \ --keychain-profile "$NOTARY_PROFILE" \ - --wait + --wait \ + --timeout 30m log "Stapling the notarization ticket onto the app" run xcrun stapler staple "$APP"