ci: wait for nightly builds before publishing the release (#2695)

GITHUB_TOKEN-dispatched builds do not trigger downstream workflow_run
jobs. The nightly release check ran before builds finished and then
exited successfully without publishing anything.

Track dispatch run IDs and wait for all missing components to succeed.
Retry failed jobs once, account for delayed rerun state, and fail on
terminal errors. Bound the build and wait job to three hours.

Pass the built commit to publication so later main commits do not
change the release target. Retain component deduplication and manual
build completion handlers, and document the nightly lifecycle.

Add regression coverage for pending builds, retries, terminal failures,
dispatch races, and main advancing before publication. All 34 Node tests
and actionlint for the three nightly workflows pass.

.github/workflows/nightly-release.yml

@@ -2,6 +2,11 @@ name: EasyTier Nightly Release
 
 on:
   workflow_call:
+    inputs:
+      sha:
+        description: Commit whose full builds the caller has waited for
+        required: true
+        type: string
   workflow_run:
     workflows: [EasyTier Core, EasyTier GUI, EasyTier Mobile, EasyTier Test]
     branches: [main]
@@ -33,11 +38,13 @@ jobs:
       - name: Select complete main builds and prepare release notes
         id: prepare
         uses: actions/github-script@v8
+        env:
+          BUILD_SHA: ${{ inputs.sha }}
         with:
           script: |
             const fs = require('node:fs');
             const { prepare } = require('./.github/scripts/nightly-release.js');
-            const build = await prepare({ github, context, core });
+            const build = await prepare({ github, context, core, sha: process.env.BUILD_SHA });
             if (!build) return;
             fs.writeFileSync('nightly-release.json', JSON.stringify(build));
             for (const workflow of ['core', 'gui', 'mobile']) {

.github/workflows/nightly.yml

@@ -18,15 +18,19 @@ jobs:
   dispatch:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    timeout-minutes: 180
+    outputs:
+      sha: ${{ steps.build.outputs.sha }}
     steps:
       - uses: actions/checkout@v5
 
-      - name: Build branches with new commits
+      - name: Build main and wait for successful results
+        id: build
         uses: actions/github-script@v8
         with:
           script: |
             const dispatch = require('./.github/scripts/nightly-build.js');
-            await dispatch({ github, context, core });
+            core.setOutput('sha', await dispatch({ github, context, core }));
 
   release:
     needs: dispatch
@@ -34,3 +38,5 @@ jobs:
       actions: read
       contents: write
     uses: ./.github/workflows/nightly-release.yml
+    with:
+      sha: ${{ needs.dispatch.outputs.sha }}