From 970aba9842f782c3aa3542a6448a1d728c45bdac Mon Sep 17 00:00:00 2001
From: dbarr5 <dkbarrante@gmail.com>
Date: Tue, 6 Oct 2026 23:01:29 -0400
Subject: [PATCH] ci(release): permit one-time PyPI recovery on self-hosted
 runner

---
 .github/workflows/publish-pypi.yml | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 0deac01a..66cb5247 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -31,6 +31,11 @@ on:
         required: false
         default: true
         type: boolean
+      manual_self_hosted:
+        description: One-time v4.20.0 recovery on the reviewed self-hosted pool
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -41,7 +46,7 @@ concurrency:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.manual_self_hosted && fromJSON('["self-hosted","Linux","X64","aether-agent-ci"]') || 'ubuntu-latest' }}
     timeout-minutes: 20
     environment: pypi-production
     permissions:
@@ -50,6 +55,15 @@ jobs:
     env:
       RELEASE_TAG: ${{ github.event.release.tag_name || inputs.ref }}
     steps:
+      - name: Limit the recovery route to v4.20.0 from main
+        if: ${{ inputs.manual_self_hosted }}
+        shell: bash
+        run: |
+          test "$GITHUB_EVENT_NAME" = workflow_dispatch
+          test "$GITHUB_REF" = refs/heads/main
+          test "$RELEASE_TAG" = v4.20.0
+          docker info --format '{{.ServerVersion}}'
+
       - name: Checkout the release tag, or main for a first publish
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -140,12 +154,21 @@ jobs:
 
       - name: Upload release evidence
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        continue-on-error: ${{ inputs.manual_self_hosted == true }}
         with:
           name: pypi-release-${{ env.RELEASE_TAG }}
           path: packages/pypi-cli/dist/*
           if-no-files-found: error
           retention-days: 90
 
+      - name: Record recovery evidence in logs
+        if: ${{ inputs.manual_self_hosted }}
+        working-directory: packages/pypi-cli
+        shell: bash
+        run: |
+          echo "Source commit: $(git rev-parse HEAD)"
+          sha256sum dist/*
+
       - name: Publish to PyPI
         if: ${{ github.event_name == 'release' || !inputs.dry_run }}
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2