From b3cc59afcf28bf8f8cc35023be67b9e2f62fc066 Mon Sep 17 00:00:00 2001
From: jif <jif@openai.com>
Date: Fri, 16 Oct 2026 15:49:47 +0000
Subject: [PATCH] Retry npm release publishing and match macOS verification
 runners (#54641)

## What changed

- Attempt each `npm publish` up to three times, with 10- and 20-second delays and fresh OIDC credentials on each attempt. Continue skipping already-published versions.
- Enable verbose npm logging and retain debug logs as artifacts for seven days, including on failure.
- Use `macos-15-intel` to verify provisioned `x86_64-apple-darwin` packages, while keeping `aarch64-apple-darwin` verification on `macos-15-xlarge`.

GitOrigin-RevId: 1876c66993ecd8cdb44088ab17a3363d21135ec4
---
 .../rust-release-provisioned-macos.yml        |  8 +++-
 .github/workflows/rust-release.yml            | 48 +++++++++++++------
 2 files changed, 40 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/rust-release-provisioned-macos.yml b/.github/workflows/rust-release-provisioned-macos.yml
index 6d1b24591f..bbed090187 100644
--- a/.github/workflows/rust-release-provisioned-macos.yml
+++ b/.github/workflows/rust-release-provisioned-macos.yml
@@ -117,7 +117,7 @@ jobs:
 
   verify:
     needs: sign
-    runs-on: macos-15-xlarge
+    runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     environment:
       name: codesigning
@@ -129,7 +129,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [aarch64-apple-darwin, x86_64-apple-darwin]
+        include:
+          - target: aarch64-apple-darwin
+            runner: macos-15-xlarge
+          - target: x86_64-apple-darwin
+            runner: macos-15-intel
     env:
       TARGET: ${{ matrix.target }}
       PROVISIONED_MACOS: "true"
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index 42011c6867..3fc99ac71b 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -1919,6 +1919,9 @@ jobs:
         env:
           VERSION: ${{ needs.release.outputs.version }}
           NPM_TAG: ${{ needs.release.outputs.npm_tag }}
+          NPM_CONFIG_LOGLEVEL: verbose
+          NPM_CONFIG_LOGS_DIR: ${{ runner.temp }}/npm-publish-logs
+          NPM_CONFIG_LOGS_MAX: "100"
         run: |
           set -euo pipefail
           prefix=""
@@ -2010,25 +2013,42 @@ jobs:
               publish_cmd+=(--tag "${tag}")
             fi
 
-            echo "+ ${publish_cmd[*]}"
-            set +e
-            publish_output="$("${publish_cmd[@]}" 2>&1)"
-            publish_status=$?
-            set -e
+            # A fresh npm process obtains new OIDC credentials on each attempt.
+            for attempt in 1 2 3; do
+              echo "+ ${publish_cmd[*]} (attempt ${attempt}/3)"
+              set +e
+              publish_output="$("${publish_cmd[@]}" 2>&1)"
+              publish_status=$?
+              set -e
 
-            echo "${publish_output}"
-            if [[ ${publish_status} -eq 0 ]]; then
-              continue
-            fi
+              echo "${publish_output}"
+              if [[ ${publish_status} -eq 0 ]]; then
+                break
+              fi
 
-            if grep -qiE "previously published|cannot publish over|version already exists" <<< "${publish_output}"; then
-              echo "Skipping already-published package version for ${filename}"
-              continue
-            fi
+              if grep -qiE "previously published|cannot publish over|version already exists" <<< "${publish_output}"; then
+                echo "Skipping already-published package version for ${filename}"
+                break
+              fi
 
-            exit "${publish_status}"
+              if [[ ${attempt} -eq 3 ]]; then
+                exit "${publish_status}"
+              fi
+              delay=$((attempt * 10))
+              echo "Publishing ${filename} failed; retrying in ${delay} seconds."
+              sleep "${delay}"
+            done
           done
 
+      - name: Retain npm debug logs
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: npm-publish-logs-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/npm-publish-logs/
+          if-no-files-found: ignore
+          retention-days: 7
+
   deploy-dev-website:
     name: Trigger developers.openai.com deploy
     needs: release