ci: harden sonatype publish status handling

Author: nobodyiam

.github/scripts/github_actions_utils.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+# Copyright 2026 Apollo Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Shared helpers for GitHub Actions scripts."""
+
+from __future__ import annotations
+
+import os
+
+
+def write_output(key: str, value: str) -> None:
+    output_path = os.environ.get("GITHUB_OUTPUT", "").strip()
+    if not output_path:
+        return
+    with open(output_path, "a", encoding="utf-8") as output:
+        output.write(f"{key}={value}\n")

.github/scripts/release_extract_upload_context.py

@@ -21,13 +21,7 @@
 import re
 from pathlib import Path
 
-
-def write_output(key: str, value: str) -> None:
-    output_path = os.environ.get("GITHUB_OUTPUT", "").strip()
-    if not output_path:
-        return
-    with open(output_path, "a", encoding="utf-8") as out:
-        out.write(f"{key}={value}\n")
+from github_actions_utils import write_output
 
 
 def main() -> int:
@@ -40,8 +34,7 @@ def main() -> int:
 
     uploaded_urls: list[str] = []
     for target_repo, url in pattern.findall(log_text):
-        normalized = target_repo.rstrip(":")
-        if normalized == repository_name:
+        if target_repo == repository_name:
             uploaded_urls.append(url)
 
     deduped_urls = sorted(set(uploaded_urls))

.github/scripts/release_resolve_repository_context.py

@@ -25,6 +25,8 @@
 from pathlib import Path
 from typing import Any
 
+from github_actions_utils import write_output
+
 OSSRH_BASE = "https://ossrh-staging-api.central.sonatype.com"
 
 
@@ -40,24 +42,17 @@ def request_json(url: str, headers: dict[str, str]) -> tuple[int | None, dict[st
             except json.JSONDecodeError:
                 return response.status, {"raw": body}
     except urllib.error.HTTPError as error:
+        body = error.read().decode("utf-8")
         try:
-            payload = json.loads(error.read().decode("utf-8"))
-        except Exception:  # noqa: BLE001
-            payload = {"error": f"HTTP {error.code}"}
+            payload = json.loads(body) if body else {}
+        except json.JSONDecodeError:
+            payload = {"raw": body}
         payload.setdefault("error", f"HTTP {error.code}")
         return error.code, payload
     except Exception as error:  # noqa: BLE001
         return None, {"error": str(error)}
 
 
-def write_output(key: str, value: str) -> None:
-    output_path = os.environ.get("GITHUB_OUTPUT", "").strip()
-    if not output_path:
-        return
-    with open(output_path, "a", encoding="utf-8") as stream:
-        stream.write(f"{key}={value}\n")
-
-
 def main() -> int:
     target_repository = os.environ.get("TARGET_REPOSITORY", "").strip()
     namespace = os.environ.get("TARGET_NAMESPACE", "").strip()

.github/scripts/sonatype_publish.py

@@ -25,6 +25,8 @@
 import urllib.request
 from typing import Any
 
+from github_actions_utils import write_output
+
 OSSRH_BASE = "https://ossrh-staging-api.central.sonatype.com"
 PORTAL_BASE = "https://central.sonatype.com"
 
@@ -64,14 +66,6 @@ def extract_deployment_state(payload: dict[str, Any]) -> str:
     return "unknown"
 
 
-def write_output(key: str, value: str) -> None:
-    output_path = os.environ.get("GITHUB_OUTPUT", "").strip()
-    if not output_path:
-        return
-    with open(output_path, "a", encoding="utf-8") as stream:
-        stream.write(f"{key}={value}\n")
-
-
 def to_int(value: str, default: int) -> int:
     try:
         return int(value)
@@ -190,7 +184,26 @@ def main() -> int:
                                 f"{PORTAL_BASE}/api/v1/publisher/status?"
                                 f"id={urllib.parse.quote(deployment_id)}"
                             )
-                            _, status_payload = request_json("POST", status_url, headers)
+                            poll_status, status_payload = request_json(
+                                "POST",
+                                status_url,
+                                headers,
+                            )
+                            if poll_status is None or poll_status < 200 or poll_status >= 300:
+                                poll_error = (
+                                    status_payload.get("error")
+                                    if isinstance(status_payload, dict)
+                                    else ""
+                                )
+                                if not poll_error:
+                                    poll_error = (
+                                        f"HTTP {poll_status}"
+                                        if poll_status is not None
+                                        else "HTTP unknown"
+                                    )
+                                reason = f"Status polling API failed: {poll_error}"
+                                break
+
                             final_state = extract_deployment_state(status_payload)
 
                             if final_state == "PUBLISHED":
@@ -234,7 +247,7 @@ def main() -> int:
 
                             time.sleep(10)
 
-                        if result != "published" and not reason and final_state != "unknown":
+                        if result != "published" and not reason:
                             reason = (
                                 "Timed out waiting for deployment status. "
                                 f"Latest state={final_state}"