From c4f33c9e3d6fff175cc098f373e15f233332fd35 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Wed, 8 Jul 2026 16:51:09 +0000
Subject: [PATCH] Gate the test matrix and retry setup-uv's flaky manifest
 fetch

The test job's job-level continue-on-error (from #708) made the required
all-green check pass even when test legs failed. Remove it, adding
fail-fast: false to keep the run-all-legs behavior it was incidentally
providing.

With the gate live, setup-uv's single-attempt manifest fetch (hard 5s
timeout, astral-sh/setup-uv#869, unfixed through v8.3.2) would become
merge-blocking, so give each setup-uv step in shared.yml one retry gated
on the step outcome; deterministic install errors still fail both
attempts. Update RELEASE.md accordingly.

No-Verification-Needed: CI workflow config with no local runtime surface; exercised via live CI runs on the PR
---
 .github/workflows/shared.yml | 56 +++++++++++++++++++++++++++++++++---
 RELEASE.md                   |  6 ++--
 2 files changed, 55 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/shared.yml b/.github/workflows/shared.yml
index 36ef4f2377..511d0340d1 100644
--- a/.github/workflows/shared.yml
+++ b/.github/workflows/shared.yml
@@ -17,10 +17,23 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      # setup-uv's manifest fetch is a single request with a hard 5s timeout
+      # (astral-sh/setup-uv#869); retry once. Drop when upstream adds a retry.
+      - name: Install uv
+        id: setup-uv
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          version: 0.9.5
+
+      - name: Install uv (retry)
+        if: steps.setup-uv.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           version: 0.9.5
+
       - name: Install dependencies
         run: uv sync --frozen --all-extras --python 3.10
 
@@ -44,8 +57,8 @@ jobs:
     name: test (${{ matrix.python-version }}, ${{ matrix.dep-resolution.name }}, ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
-    continue-on-error: true
     strategy:
+      fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
         dep-resolution:
@@ -60,7 +73,18 @@ jobs:
         with:
           persist-credentials: false
 
+      # setup-uv's manifest fetch is a single request with a hard 5s timeout
+      # (astral-sh/setup-uv#869); retry once. Drop when upstream adds a retry.
       - name: Install uv
+        id: setup-uv
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          version: 0.9.5
+
+      - name: Install uv (retry)
+        if: steps.setup-uv.outcome == 'failure'
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
@@ -92,7 +116,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      # setup-uv's manifest fetch is a single request with a hard 5s timeout
+      # (astral-sh/setup-uv#869); retry once. Drop when upstream adds a retry.
+      - name: Install uv
+        id: setup-uv
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          version: 0.9.5
+
+      - name: Install uv (retry)
+        if: steps.setup-uv.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           version: 0.9.5
@@ -115,7 +151,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      # setup-uv's manifest fetch is a single request with a hard 5s timeout
+      # (astral-sh/setup-uv#869); retry once. Drop when upstream adds a retry.
+      - name: Install uv
+        id: setup-uv
+        continue-on-error: true
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          version: 0.9.5
+
+      - name: Install uv (retry)
+        if: steps.setup-uv.outcome == 'failure'
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
           version: 0.9.5
diff --git a/RELEASE.md b/RELEASE.md
index 70eef5d692..f86da2ea67 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -39,9 +39,9 @@ the publish job — `skip-existing` makes it skip whatever already landed. The
    commit — and therefore the README PyPI publishes — names the version
    being released. When entering a new phase (alpha → beta → rc), update
    the banner wording too.
-2. Check the full test matrix is green on the release commit. The matrix runs
-   with `continue-on-error`, so a green workflow run does not mean the tests
-   passed — check the individual jobs.
+2. Check the full test matrix is green on the release commit. The publish
+   workflow re-runs the checks and blocks publishing until they pass, so a
+   red leg there means re-running the failed jobs on the Publishing run.
 3. Create the release as a pre-release, passing the exact commit verified in
    step 2 as `--target` (otherwise the tag is created from whatever `main`'s
    HEAD is by then). The tagged commit determines everything about the