From e8f16b2e78590549512d0a505ab9bd0878e61ea7 Mon Sep 17 00:00:00 2001 From: TerrifiedBug Date: Thu, 27 Aug 2026 20:42:05 +0100 Subject: [PATCH] ci: resolve dependencies before touching the keychain Two v0.1.0 attempts stalled 20+ minutes on "Downloading binary artifact Sparkle-for-Swift-Package-Manager.zip" inside build-release.sh, leaving an orphan swift-package process. CI's plain swift build fetched the same zip in 24s on the same runner image, so it is not the network: the difference is that the release job had already created and unlocked a custom keychain and replaced the user keychain search list. Resolve at the top of the job instead, before any signing state exists, and bound both steps so a stall costs minutes instead of the whole job. --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 436c39e..6cf0ad6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -49,6 +49,15 @@ jobs: with: xcode-version: latest-stable + # SwiftPM fetches Sparkle's ~11 MB binary artifact here. Do it before the + # keychain and notary steps: two v0.1.0 attempts stalled 20+ minutes on + # this exact download inside build-release.sh, while CI's plain + # `swift build` fetched it in 24s on the same runner image. Bounded, so a + # stall costs 8 minutes instead of the whole 45-minute job. + - name: Resolve dependencies + timeout-minutes: 8 + run: swift package resolve + - name: Resolve version id: v env: @@ -127,6 +136,7 @@ jobs: rm -f "$RUNNER_TEMP/notary.p8" - name: Build, sign, notarize + timeout-minutes: 25 env: VERSION: ${{ steps.v.outputs.version }} APP_IDENTITY: ${{ secrets.APP_IDENTITY }}