Linux lane: pin the PBS release from the manifest; retry transient GitHub API errors

The first python-315 CI run lost all three stable-minor Linux jobs to
HTTP 504s from the GitHub release-listing API (during the Actions outage
recovery). Two structural fixes beyond retries:

- The CI step now derives PYTHON_DIST_RELEASE from the manifest row's
  standalone_release_date, so resolve_pbs.py builds the canonical URL with
  zero API calls (verified: all four pinned assets exist). The newest PBS
  release stopped carrying our pinned micros once upstream bumped to
  3.12.14/3.13.15/3.14.7, so the auto-resolve path had become a mandatory
  paginated scan on every stable-minor run. Manifest stays the single
  source of truth; auto-resolution remains the fallback for a missing
  field, and an explicit PYTHON_DIST_RELEASE still wins.
- resolve_pbs.py retries 429/5xx and network errors with backoff, and the
  fallback scan uses small pages (20/page, 200 releases) — the giant
  100-release payloads with hundreds of assets each are exactly what the
  degraded API times out on.

Author: ndonkoHenri

.github/workflows/build-python-version.yml

@@ -191,6 +191,18 @@ jobs:
           # Lets resolve_pbs.py authenticate to the GitHub API and avoid rate limits.
           GITHUB_TOKEN: ${{ github.token }}
         run: |
+          # Pin the PBS release from the manifest (single source of truth) so
+          # resolve_pbs.py needs no API calls at all — the newest PBS release
+          # no longer carries our pinned micros once upstream bumps them, and
+          # the release-listing API 504s when degraded (took down this lane).
+          # An empty/missing manifest field falls back to auto-resolution, and
+          # a workflow-level PYTHON_DIST_RELEASE override still wins.
+          if [ -z "${PYTHON_DIST_RELEASE:-}" ]; then
+            PYTHON_DIST_RELEASE=$(jq -r --arg v "$PYTHON_VERSION_SHORT" \
+              '.pythons[$v].standalone_release_date // empty' ../manifest.json)
+            export PYTHON_DIST_RELEASE
+            echo "PBS release from manifest: ${PYTHON_DIST_RELEASE:-<none, auto-resolve>}"
+          fi
           bash ./package-for-linux.sh x86_64 "_v2"
           bash ./package-for-linux.sh aarch64 ""
 

linux/resolve_pbs.py

@@ -21,6 +21,7 @@
 import json
 import os
 import sys
+import time
 import urllib.error
 import urllib.request
 
@@ -31,7 +32,10 @@
 # PBS has a very long release history. A target micro that we'd ship is always recent,
 # so bound the newest-first fallback scan rather than crawling every page (which both
 # burns rate limit and risks gateway timeouts when the asset genuinely doesn't exist).
-MAX_FALLBACK_PAGES = 5  # 5 * 100 = 500 most-recent releases
+# Small pages on purpose: each PBS release carries hundreds of assets, and big
+# release-list payloads are exactly what the GitHub API 504s on when degraded.
+PER_PAGE = 20
+MAX_FALLBACK_PAGES = 10  # 10 * 20 = 200 most-recent releases
 
 
 def asset_name(version: str, arch: str, arch_ver: str, release: str) -> str:
@@ -42,15 +46,28 @@ def asset_name(version: str, arch: str, arch_ver: str, release: str) -> str:
     )
 
 
-def _get(url: str) -> bytes:
+def _get(url: str, attempts: int = 4) -> bytes:
     req = urllib.request.Request(url)
     req.add_header("Accept", "application/vnd.github+json")
     req.add_header("X-GitHub-Api-Version", "2022-11-28")
     token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
     if token:
         req.add_header("Authorization", f"Bearer {token}")
-    with urllib.request.urlopen(req, timeout=60) as resp:
-        return resp.read()
+    for attempt in range(1, attempts + 1):
+        try:
+            with urllib.request.urlopen(req, timeout=60) as resp:
+                return resp.read()
+        except urllib.error.HTTPError as exc:
+            # The GitHub API 504s/503s transiently under load (seen taking down
+            # whole CI runs); retry those with backoff. Other 4xx are real
+            # answers the callers handle — surface them immediately.
+            if exc.code not in (429, 500, 502, 503, 504) or attempt == attempts:
+                raise
+        except (urllib.error.URLError, TimeoutError):
+            if attempt == attempts:
+                raise
+        time.sleep(2**attempt)
+    raise AssertionError("unreachable")
 
 
 def _find_in_release(release: dict, version: str, arch: str, arch_ver: str) -> str | None:
@@ -74,7 +91,7 @@ def resolve(version: str, arch: str, arch_ver: str) -> str:
 
     # Fall back to paging newest-first (bounded) until we find a release with the asset.
     for page in range(1, MAX_FALLBACK_PAGES + 1):
-        releases = json.loads(_get(f"{API}?per_page=100&page={page}"))
+        releases = json.loads(_get(f"{API}?per_page={PER_PAGE}&page={page}"))
         if not releases:
             break
         for release in releases:  # API returns newest-first
@@ -85,7 +102,7 @@ def resolve(version: str, arch: str, arch_ver: str) -> str:
     raise SystemExit(
         f"No python-build-standalone asset found for "
         f"{asset_name(version, arch, arch_ver, '<release>')} "
-        f"in the {MAX_FALLBACK_PAGES * 100} most-recent releases."
+        f"in the {MAX_FALLBACK_PAGES * PER_PAGE} most-recent releases."
     )