feat(updater): run every updater stage as one job per cask

[edbfi]

What changed

PR 2 of 2, following #49. Every stage of update-casks.yml now runs one job per cask with that cask's own timeout. Six casks no longer fills the updater, and adding a cask never touches the workflow.

discover → check (per cask) → plan → publish (per cask) → published → verify (per cask) → verified → push (per cask, one at a time)

• Timeouts: every per-cask job uses timeout-minutes: ${{ matrix.minutes }}, which is the cask's UPDATE_MINUTES (default 20; no cask sets it). check and verify drop from 30 to 20 minutes. The longest updater job in the last 40 runs took 45 s.
• Failures: each cask fails on its own (fail-fast: false), so a broken cask shows up as its own red job, e.g. publish (flixor), and the others carry on.
• Push: max-parallel: 1, so each push starts from a fresh clone of a main that already has the previous cask's commit, and every push is a plain fast-forward. push's existing three-try loop still covers an owner push landing mid-run. It's still one commit and one deploy-key push per cask, as today.
• Collectors:
  • published lists the casks whose publish (TOKEN) job succeeded in this attempt, read from the jobs API. A marker artifact would have been more robust, but d8.md's Verification requires publish to have no uses: lines. WorkflowTests pins the job name, so a rename fails CI rather than going silent.
  • verified lists checked- artifacts, so a failed verify doesn't also turn that cask's push red.
• Unchanged: the four security roles, rules 8–13, the update-casks concurrency group, the no-update run (plan → [], everything after it skipped), and the refusal of re-runs.
• Scripts: publish and push now take one token. The loop stages, PUBLISH_DEADLINE/PUSH_DEADLINE, the timeout wrappers and DeadlineTests are gone. feat(updater): add per-cask publish and push stages with their own budgets #49's publish-one/push-one fold into them.
• README: "How it works" and "Adding a cask" mention UPDATE_MINUTES.

Evidence

• prek run --all-files --hook-stage manual: every hook passes (actionlint, zizmor, privileged-jobs, shellcheck, tooling tests).
• python3 -m unittest discover -s tests and -s scripts/tests: OK (27 and 28 tests, on Python 3.14).
• WorkflowTests fails if the publish job is renamed or max-parallel: 1 is removed (both mutations tried).
• published fails rather than reporting [] when the jobs API errors.

Plan after merge

1. A dispatch with nothing to update: check (…) for each cask, plan → [], everything after it skipped.
2. edbfi-ci: d8.md rules 8/10/12 and the Verification bullets, plus the STATE row.
3. Production check: two probe casks (updater-probe, updater-probe-b) updating in one run, so two publish jobs run in parallel and two push jobs land one after the other, both logged as bypass. A second dispatch should do nothing. Then a deliberately failing probe to show that it fails on its own. Then a teardown PR.

Owner actions

None.

[pullfrog]

ℹ️ No critical issues — one nitpick inline.

Reviewed changes: the full PR (single commit) across the workflow, scripts/update.sh, the fake gh and the updater tests.

• Per-cask jobs in update-casks.yml: check, publish, verify and push use include: fromJSON(...matrix), fail-fast: false, explicit name: <stage> (TOKEN) and timeout-minutes: ${{ matrix.minutes }}; push adds max-parallel: 1. The privileged jobs keep their branch guard and still run main's scripts.
• Collector jobs: published reads succeeded publish (TOKEN) jobs from the jobs API (a failing API call aborts under set -e rather than reporting []). verified lists checked- artifacts.
• scripts/update.sh: the loop stages, timeout wrappers, deadlines and *-one variants are gone; publish TOKEN and push TOKEN call first_attempt. stage_listed now takes a pattern and a lister function.
• Tests and docs: DeadlineTests becomes WorkflowTests, the fake gh gains a jobs endpoint, and the README documents UPDATE_MINUTES.

I traced the job if conditions and needs chain for the no-update, partial-failure and all-failed cases and found them consistent. The empty-discovery case is covered by discover.sh dying when nothing matches.

Nitpicks

• tests/test_updater.py:19 — the fake curl's "stall" branch is now dead: its only user, test_a_stalled_cask_times_out_and_the_rest_publish, was removed along with the timeout wrappers. Drop the branch (and its import time) so the fixture doesn't advertise a behavior nothing exercises.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}