ci: make crates.io publish idempotent and retry index lag

[lwshang]

What

Make the Publish to crates.io workflow idempotent and resilient to crates.io index lag.

Why — the 0.48.0 release half-failed

The publish job ran six cargo publish commands unguarded under set -e. During the 0.48.0 release (run):

• ✅ ic-transport-types, ic-agent, ic-identity-hsm, ic-utils uploaded 0.48.0
• ❌ cargo publish -p icx then failed: failed to select a version for the requirement ic-utils = "^0.48.0" — ic-utils 0.48.0 had been uploaded ~60s earlier but hadn't yet appeared in the crates.io index (cargo's built-in wait timed out, then the resolve hard-failed). icx-cert never ran.

Two brittleness sources:

1. Partial release can't be resumed. Re-dispatching aborts on the first command, since cargo publish -p ic-transport-types now errors with "crate version already uploaded" and set -e kills the step.
2. Index lag. A dependent crate can fail to resolve a just-uploaded dependency for a minute or two.

Fix

Wrap each publish in a helper that:

• treats "already uploaded/exists" as success → idempotent, so a re-dispatch finishes the crates that didn't make it without re-publishing the ones already live;
• retries other failures up to 6× with a 30s backoff → rides out index lag between dependent crates.

Order (dependencies before dependents) is unchanged.

Rollout

The Identity team's blocker is already resolved — ic-agent 0.48.0 and ic-transport-types 0.48.0 are live. After merging this, re-dispatch the workflow: it will skip the four published crates and publish icx + icx-cert (both currently still at 0.47.3).

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 72f7710.

Security Overview

• 🔎 Scanned files: 1 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/a3a96bf1-e1e7-4946-9d69-cd1493c911f8?scanId=639a1110-9331-473e-a5a0-c91874394ce0&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► .github/workflows/publish.yml     Refine cargo publish loop to retry on failures and handle already published crates; implement robust publish() with retries and index lag handling ► (No other files changed in diff)

[Copilot]

Pull request overview

This PR updates the crates.io publish GitHub Actions workflow to be resilient to partial publishes and crates.io index lag by making publishing idempotent and adding retry/backoff behavior.

Changes:

• Add a publish() helper that treats “already uploaded/exists” as success to allow safe re-dispatch after partial releases.
• Retry failed publishes up to 6 times with a 30s backoff to tolerate crates.io index propagation delays.
• Keep publish order dependency-first to reduce resolution failures between crates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.