Wait for new Ghost version on npm before committing/opening upstream PR

[acburdine]

Problem

The ghost-version-publish dispatch can arrive before the new Ghost version is installable from npm. The Ghost-CLI images (6) run ghost install <version> against npm at build time, so both this repo's CI (kicked off by the pushed commit) and the official-images PR checks regularly fail on that race.

Change

Adds a Wait for Ghost on npm step to update.yml, ahead of Commit and push changes:

• For each versions.json entry with a .cli pin, polls registry.npmjs.org/ghost until the version shows up in both the abbreviated (application/vnd.npm.install-v1+json) and full packuments (cached independently), then confirms the tarball responds.
• Sends Cache-Control: no-cache, polls every 30s, gives up after 30 minutes.
• On timeout the run fails before anything is pushed, so the existing Slack failure alert fires and a re-run starts clean.
• Skipped on dry runs, and when there's nothing to commit and no upstream PR to open.
• 6-next installs from the GitHub release tarball, which versions.sh already waits for, so it isn't checked.

Check logic was tested locally against the live registry (passes for 6.68.0, keeps waiting on a nonexistent 6.999.0); the workflow itself hasn't run in Actions yet.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 27b17386-6abb-44df-be92-95e1373a98a8

📥 Commits

Reviewing files that changed from the base of the PR and between e66ac58 and bfbeed0.

📒 Files selected for processing (1)

• .github/workflows/update.yml

Included review availability: This review used your included allowance. Your plan provides up to 5 included reviews per hour; 3 remain after this review.

---

Walkthrough

The update workflow adds a pre-push check for Ghost versions with CLI pins. When the workflow is not a dry run and either Dockerfiles changed or pull request creation is enabled, it checks both npm packument formats and the listed tarball URL. Checks repeat every 30 seconds. The step fails if availability is not confirmed within 30 minutes.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bfbee

The availability check is ready to merge after normal workflow checks; neither reported concern establishes a failure that would block a valid update or allow an unavailable package through.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: waiting for a new Ghost version to appear on npm before committing or opening an upstream PR.
Description check	✅ Passed	The description explains the npm publishing race and the workflow step that waits for the version and tarball before pushing changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}