ci: give the npm wait a real budget and drop the back-publish path

[colinhacks]

4.6.0 sat in npm's automated review for 116 minutes against a 150 minute window, so the release came within half an hour of failing after the publish had already succeeded. If that wait had expired, the run would have skipped the GitHub release, the JSR publish and both @zod/mini publishes, leaving zod on npm without its twin.

The zod wait goes to 240 minutes and @zod/mini's to 90. The split is not arbitrary: mini publishes only after zod's review has drained, and on 4.6.0 it cleared in under a minute, so the budget belongs to the first wait. The pair still shares the job's 6h cap, which is GitHub's hard limit for a hosted runner rather than a tunable. Going past it means moving the wait into its own job, and since the publish steps are bound to the npm environment that would cost a second approval per release.

Separately, the mini_version input and the backpublish_mini job come out. @zod/mini has shipped in lockstep since 4.5.0 and 4.5.0 through 4.5.4 were backfilled at the time, so no zod version is missing a twin and the input had nothing left to do. Every zod version at or above 4.5.0 currently has a mini twin and the latest tags match. Removing it also drops the four if: inputs.mini_version == '' guards that made each normal job conditional.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the release workflow's npm wait-budget reallocation and removal of the completed mini back-publish path.

• Wait budgets — Gives the initial zod registry review up to 240 minutes and reserves 90 minutes for the subsequent @zod/mini check within the hosted-runner limit.
• Release cleanup — Removes the mini_version input, its dedicated back-publish job, and the conditional guards from the normal release jobs now that stable versions are in lockstep.
• Operational context — Updates the workflow comments with the observed 4.6.0 review delay and the reason for the asymmetric budgets.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[Copilot]

🟡 Changes recommended

Unresolved issues remain with bounded curl waits, partial-release recovery, and comment formatting.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the npm release workflow for longer review delays and removes obsolete mini back-publishing support.

Changes:

• Extends npm wait budgets for zod and @zod/mini.
• Removes mini_version, conditional guards, and backpublish_mini.
• Retains lockstep verification.

File summaries

File	Description
.github/workflows/release.yml	Adjusts release timing and removes back-publish logic.

Review details

Suppressed comments (3)

.github/workflows/release.yml:194

• The mini wait has the same unbounded-request problem: a stalled curl can make the nominal 90-minute budget exceed its allowance and consume the remaining job cap. Bound the registry request timeout separately from the iteration count.

          for i in $(seq 1 90); do
            if curl -sf "https://registry.npmjs.org/@zod%2fmini/$VERSION" > /dev/null; then

.github/workflows/release.yml:115

• This changed line retains several full sentences and a historical narrative, contrary to the repository's short-comment convention. Keep the operational history in the PR description and reduce this to the reason the step waits.

      # npm holds a publish in automated review before serving it, and the version is unavailable until that finishes: 4.5.0 sat 16 minutes, 4.5.3 sat 25, and 4.6.0 sat 116. None of those is an upper bound. The version does arrive, and the release and the JSR publish are worthless without it, so wait rather than fail. A publish that failed for some other reason waits the whole window and then fails with the publish step's log to read.

.github/workflows/release.yml:67

• Removing the dispatch input and backpublish job leaves no workflow path to repair a partial release after a newer zod version is published. The normal job only reads the current packages/mini version, while the final lockstep check then fails on any older missing twin; preserve a recovery mechanism or make recovery independent of the current version.

  build_and_publish:

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.