[necolas]

A slow registry no longer skips the Go tag. The npm job of publish-sdk.yml now only publishes, and a new last job, "Check the published versions", waits up to 10 minutes for npm, PyPI, and the Go proxy. Its failure skips no publish. Also, check-sdk-build refuses a published version only in a release pull request, so a pull request that changes a workflow or a script after a release can pass.

Why

The publish of 0.1.0-canary.6 (run 40963162715, attempt 1):

1. pypi published pierre-sdk 0.1.0.dev6, and npm published @pierre/sdk and @pierre/cli 0.1.0-canary.6.
2. The step "Check the npm tags" asked for dist-tags.canary 12 times, 10 seconds apart.

Expected: the run tags go/v0.1.0-canary.6.
Actual: the step failed with "@pierre/sdk has canary at '0.1.0-canary.5', not 0.1.0-canary.6", and the go job was skipped. The registry showed the new tag 3 seconds later. A second run of all jobs was necessary to push the Go tag.

After that release, check-sdk-build failed on this pull request with "the registries already have 0.1.0-canary.6", because sdk-build.json on main names a published version, and the check refused it on each pull request.

Scope

• npm: the step "Check the npm tags" is removed. go still needs npm, so the Go tag comes only after npm accepts both packages.
• go: it only tags. The request to the Go proxy moves to the new job.
• check ("Check the published versions"): it runs after go, when no job failed. Every 20 seconds, for up to 10 minutes, it asks for the npm dist-tags of each package, the PyPI version, and proxy.golang.org/.../@v/v<version>.info, and it names each one that is still missing. It needs no permission and no checkout.
• plan gives python_version as an output, for the PyPI request.
• scripts/sdk_build.py check --base <commit> refuses a version that a registry has only when sdk-build.json differs from the base commit. check-sdk-build.yml fetches the base of the pull request and passes it. Without --base, the rule applies as before. The other checks of the build do not change, so a change in typescript/ without sdk-build.json still fails.
• The header comment and AGENTS.md name "Re-run all jobs". "Re-run failed jobs" keeps the outputs of the first plan, so it can publish to npm again and fail.

Tradeoffs

• A version that a registry does not show after 10 minutes fails the run, but the packages and the Go tag are published. A run of all jobs then publishes nothing and checks again.
• The npm warning "bin[pierre]" script name dist/cli.js was invalid and removed does not change. npm 11.21.0 prints it also for npm publish inside cli/. npm only removes the leading ./ of ./dist/cli.js, and the published package keeps bin.pierre as dist/cli.js. npx @pierre/cli@0.1.0-canary.6 version and a global install work.

Evidence

• The script of the new job, run locally with the values of 0.1.0-canary.6, reports each of the four as published in under one second.
• With the version 9.9.9-canary.1 and a deadline of 1 second, it fails with exit status 1 and names each of the four.
• The workflows parse, and check needs plan, pypi, npm, and go.
• New tests in scripts/tests/test_sdk_build.py (PullRequestTest), with the registries patched to have the version: a pull request that keeps sdk-build.json passes; a pull request whose base has the previous build, or no build, fails; with no base it fails; an unknown base fails and names it. python -m unittest discover -s scripts/tests runs 27 tests, and they pass.
• On this branch, sdk_build.py check --base <main> passes with "sdk-build.json does not change"; with no base, and with the commit of the previous release as base, it fails with "the registries already have 0.1.0-canary.6".