fix(ci): retry npm publish on transient registry errors

.github/workflows/publish.yml

@@ -441,6 +441,8 @@ jobs:
           NPM_TAG: ${{ needs.compute-version.outputs.npm_tag }}
         shell: bash
         run: |
+          source scripts/npm-publish-retry.sh
+
           # Format: pkg_name|os|cpu|libc (libc empty for non-linux)
           declare -A PACKAGES=(
             ["linux-x64"]="@optave/codegraph-linux-x64-gnu|linux|x64|glibc"
@@ -498,14 +500,19 @@ jobs:
             fi
 
             echo "Publishing ${pkg_name}@${VERSION} with --tag ${NPM_TAG}"
-            npm publish "${PKG_DIR}/$platform" --access public --provenance --tag "$NPM_TAG"
+            npm_publish_retry "${pkg_name}@${VERSION}" npm publish "${PKG_DIR}/$platform" --access public --provenance --tag "$NPM_TAG"
           done
 
       - name: Publish main package
         if: steps.check-main.outputs.already_published == 'false'
         env:
           NPM_TAG: ${{ needs.compute-version.outputs.npm_tag }}
-        run: npm publish --access public --provenance --tag "$NPM_TAG"
+        shell: bash
+        run: |
+          source scripts/npm-publish-retry.sh
+          PKG_NAME=$(node -p "require('./package.json').name")
+          PKG_VERSION=$(node -p "require('./package.json').version")
+          npm_publish_retry "${PKG_NAME}@${PKG_VERSION}" npm publish --access public --provenance --tag "$NPM_TAG"
 
       - name: Configure git
         run: |

scripts/npm-publish-retry.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Retry wrapper for npm publish — handles transient registry errors (E404, E500, ETIMEDOUT).
+# Between retries, checks whether the package already landed on the registry (slow-success
+# scenario where the server accepted the upload but the client timed out before receiving 200).
+#
+# Usage: npm_publish_retry <pkg_name>@<version> <publish_command...>
+#   e.g. npm_publish_retry "@optave/codegraph@3.9.0" npm publish ./pkg --access public
+#
+# Arguments:
+#   $1        — package spec for idempotency check (e.g. "@optave/codegraph@3.9.0")
+#   $2...$N   — the full npm publish command to execute
+
+npm_publish_retry() {
+  local pkg_spec="$1"
+  shift
+  local max_attempts=3
+  local delay=10
+  for attempt in $(seq 1 $max_attempts); do
+    if "$@"; then
+      return 0
+    fi
+    # Before retrying, check if the publish already landed (slow-success / ETIMEDOUT)
+    if npm view "$pkg_spec" version 2>/dev/null; then
+      echo "::notice::$pkg_spec is now visible on the registry — treating as success"
+      return 0
+    fi
+    if [ "$attempt" -lt "$max_attempts" ]; then
+      echo "::warning::npm publish attempt $attempt/$max_attempts failed — retrying in ${delay}s..."
+      sleep "$delay"
+      delay=$((delay * 2))
+    fi
+  done
+  echo "::error::npm publish failed after $max_attempts attempts"
+  return 1
+}