fix(ci): use PyPI JSON API for availability check to avoid pip cache staleness (#341)

* fix(ci): use PyPI JSON API for availability check to avoid pip cache staleness

Replace `pip install --dry-run` with a `curl` call to the PyPI JSON API.
The pip approach caches index responses, so retries within the same job
would never see a newly-published version once a stale miss was cached.
Also extend the timeout from 5 to 15 minutes (30→90 attempts).

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>

* fix(ci): add --no-cache-dir to pip dry-run to avoid stale index cache

Without --no-cache-dir, pip caches the index response from the first
poll attempt. If the package wasn't available yet, all subsequent retries
served the stale cached miss — even across job re-runs.

Also extends timeout from 5 to 15 minutes (30→90 attempts).

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>

* fix(ci): use pip exit code instead of output grep for PyPI availability check

Rely on pip's exit code (0 = resolvable, 1 = not found) rather than
grepping for "Would install" in stdout, which is fragile and breaks
when the package is already installed in the environment.

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>

* fix(ci): add skip-existing to PyPI publish to allow workflow_dispatch re-runs

Without this, triggering workflow_dispatch after a partial release failure
would fail at publish-to-pypi (version already exists), blocking the
downstream publish-image-to-ghcr job.

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>

* fix(ci): skip branch check on workflow_dispatch in check-release

github.event.release.target_commitish is only set on release events,
not workflow_dispatch. Skip the branch check when manually dispatching
so re-runs of failed release jobs are not blocked.

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>

* Revert "fix(ci): skip branch check on workflow_dispatch in check-release"

This reverts commit 85968b2.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

---------

Signed-off-by: Jimisola Laursen <jimisola@users.noreply.github.com>
Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/release_prod.yml

@@ -40,6 +40,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           sign-artifacts: true
+          skip-existing: true
 
   publish-image-to-ghcr:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
@@ -71,15 +72,15 @@ jobs:
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           echo "Waiting for reqstool==${VERSION} to become available on PyPI..."
-          for i in $(seq 1 30); do
-            if pip install --dry-run "reqstool==${VERSION}" 2>&1 | grep -q "Would install"; then
+          for i in $(seq 1 90); do
+            if pip install --dry-run --no-cache-dir "reqstool==${VERSION}" &>/dev/null; then
               echo "reqstool==${VERSION} is available on PyPI"
               exit 0
             fi
-            echo "Attempt ${i}/30 - not yet available, waiting 10s..."
+            echo "Attempt ${i}/90 - not yet available, waiting 10s..."
             sleep 10
           done
-          echo "::error::reqstool==${VERSION} not found on PyPI after 5 minutes"
+          echo "::error::reqstool==${VERSION} not found on PyPI after 15 minutes"
           exit 1
 
       - name: Set up Docker Buildx