ci(release): rate-limit aware publish loop

crates.io caps new-crate names at ~1 per 10 minutes (burst of 5). The
prior loop blasted them at ~15s intervals and the v1.2.0 run hit 429
after publishing 5 of 16 crates.

Replace the three layered batches with one combined loop that:
  1. Queries the crates.io API for each name+version before uploading
     and skips if already present (idempotent recovery).
  2. Sleeps 615s after every successful new-crate upload.

Dep ordering is preserved by the loop ordering (layer 0 → 1 → 2). Job
timeout-minutes raised to 240 because 16 fresh names × ~10min plus
verify time runs close to 3h.

Re-run via workflow_dispatch (force_publish=true) after merge to drain
the 11 remaining unpublished crates.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: KeyCode17

.github/workflows/release.yml

@@ -195,54 +195,62 @@ jobs:
           toolchain: "1.95"
       - uses: Swatinem/rust-cache@v2
 
-      - name: Publish layer 0 (no internal deps)
+      # crates.io rate-limits NEW crate names at ~1 per 10 minutes (a
+      # short burst of 5 is allowed). When publishing 16 fresh names in a
+      # single run we therefore have to:
+      #   1. Skip names that are already at this version (idempotent re-run).
+      #   2. Sleep 600s between every NEW upload to stay under the cap.
+      # The two layered loops below preserve dep ordering, but the inner
+      # loop is now a per-crate rate-aware step.
+      - name: Publish all 16 lib crates (rate-limit aware, idempotent)
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          PUBLISH_SLEEP: "615"   # 10 min + buffer; new-crate cap is 1/10min
         shell: bash
+        timeout-minutes: 240
         run: |
           set -euo pipefail
-          for c in pxsolver-core pxsolver-types pxsolver-errors; do
-            echo "::group::cargo publish -p ${c}"
-            cargo publish -p "${c}"
+          VERSION="${{ needs.guard.outputs.version }}"
+
+          publish_one() {
+            local crate="$1"
+            # crates.io API returns 200 for known version, 404 if not.
+            local code
+            code=$(curl -sS -o /dev/null -w '%{http_code}' \
+              "https://crates.io/api/v1/crates/${crate}/${VERSION}" || echo "000")
+            if [[ "${code}" == "200" ]]; then
+              echo "::notice::${crate} ${VERSION} already on crates.io — skipping"
+              return 0
+            fi
+            echo "::group::cargo publish -p ${crate}"
+            cargo publish -p "${crate}"
             echo "::endgroup::"
-          done
+            echo "Sleeping ${PUBLISH_SLEEP}s to stay under new-crate rate limit"
+            sleep "${PUBLISH_SLEEP}"
+          }
 
-      - name: Wait for crates.io index (layer 0)
-        run: sleep 45
+          # Layer 0 (no internal deps)
+          for c in pxsolver-core pxsolver-types pxsolver-errors; do
+            publish_one "${c}"
+          done
 
-      - name: Publish layer 1 (deps on layer 0 only)
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        shell: bash
-        run: |
-          set -euo pipefail
+          # Layer 1 (depends on layer 0)
           for c in pxsolver-validation pxsolver-cache pxsolver-detector \
                    pxsolver-harvester pxsolver-pipeline pxsolver-native \
                    pxsolver-auth; do
-            echo "::group::cargo publish -p ${c}"
-            cargo publish -p "${c}"
-            echo "::endgroup::"
+            publish_one "${c}"
           done
 
-      - name: Wait for crates.io index (layer 1)
-        run: sleep 45
-
-      - name: Publish layer 2 (deps on layer 0 + 1)
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
-        shell: bash
-        run: |
-          set -euo pipefail
+          # Layer 2 (depends on layer 0 + 1)
           for c in pxsolver-perimeterx pxsolver-cloudflare pxsolver-turnstile \
                    pxsolver-captcha pxsolver-datadome pxsolver-camoufox; do
-            echo "::group::cargo publish -p ${c}"
-            cargo publish -p "${c}"
-            echo "::endgroup::"
+            publish_one "${c}"
           done
 
       - name: Summary
         run: |
-          echo "Published 16 pxsolver-* crates at v${{ needs.guard.outputs.version }} (${{ needs.guard.outputs.bump_kind }} bump)"
+          echo "Publish loop complete for v${{ needs.guard.outputs.version }} (${{ needs.guard.outputs.bump_kind }} bump)."
+          echo "Any crates already at this version were skipped idempotently."
 
   skipped-notice:
     name: crates.io publish skipped