[lwshang]

During the v1.8.0 release, scripts/release.sh stopped at step 4 even though the publish had worked. release-npm.yml succeeded and npm replied "Your package is being processed and may take a few minutes to become available". The script gave the registry only 30 seconds to list @icp-sdk/icp-cli@1.8.0, then failed.

• release-npm.yml gets a run-name: Publish 1.8.0 to npm from v1.8.0, plus (beta) for beta runs. The script uses it to find the run for this release. A workflow_dispatch run's inputs aren't visible in gh run list, and the old ensure_workflow_run matched any run of the workflow. Matching the npm version and the beta flag along with the tag means a run that published a different version from the same tag doesn't count.
• Step 4 counts npm as done once that run has succeeded, even if the registry doesn't list the version yet. If the run is in flight, the script watches it. If there's no run, or the last one failed, it dispatches a new one and finds it by its title. It doesn't take the workflow's newest run, which could belong to a concurrent release. Re-dispatching is safe anyway, because publish-all.sh skips versions that are already published.
• After that, the script polls the registry against a 10-minute deadline (NPM_VISIBLE_TIMEOUT_SECONDS), and each registry request times out after 15 seconds. If the version still isn't listed, it warns and carries on: neither the homebrew step nor the docs step depends on npm.

Also in this PR, because CI needed it: Wasmtime 49.0.4 → 49.0.5 (wasmtime, wasmtime-wasi). cargo-deny began rejecting 49.0.4 over four new advisories, which failed dependencies:required here:

• RUSTSEC-2026-0420: cross-engine type confusion
• RUSTSEC-2026-0422: a panic from an insufficient type check
• RUSTSEC-2026-0423: unchecked memory use when passing borrowed resources between components
• RUSTSEC-2026-0424: a WASI UDP send issue

Only Wasmtime's own crates move in Cargo.lock (wasmtime, cranelift, pulley, wiggle). This patches the runtime that runs plugin sync steps and extensions. Nothing else about them changes.

Tested:

• bash -n scripts/release.sh.
• The run matcher, against the live run list and a sample list. It picks the run whose title matches and ignores runs for another npm version and beta runs.
• After the Wasmtime bump, cargo deny check advisories passes, and cargo check passes for icp-sync-plugin and icp-extension.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Workflow matching can select a different package version or concurrent release, causing required publishing to be skipped or the script to continue despite the intended release failing.

3 open issues

• Include the effective npm version in release run matching · New
• Watch the newly dispatched release-specific workflow run · New
• Bound registry requests by the remaining timeout budget · New

What changed in this PR

This PR updates release automation so delayed npm registry visibility does not stop the remaining release steps after a successful publish workflow.

Changes:

• Adds a release-tag-specific workflow run title for npm publishing.
• Reuses successful or in-flight matching runs before dispatching another publish.
• Extends registry polling to a nominal ten minutes, then warns and continues.

File	Description
scripts/​release.sh	Adds npm run lookup and nonfatal registry visibility polling.
.github/​workflows/​release-npm.yml	Adds a run title containing the release tag.

_{Review effort: Balanced}