[ryan-morris]

Why

Release run 37631795508 failed on one cell, 9.0.2 osx-x64 (gplv2), even though its build succeeded. actions/upload-artifact died partway through the transfer to blob storage, after 8 MiB, with no error message. Recovering meant re-running the whole hour-long macOS build by hand.

Artifact transfer has no retry of its own. The iOS and SHA256SUMS release uploads had none either.

This PR also fixes a separate silent problem. The default concurrency.queue: single keeps only one pending release:

• A release that arrives while another is pending cancels and replaces the pending one.
• So merging several release-triggering PRs during a long release dropped the middle ones.
• Each run selects only what its own push changed, so nothing ever built the dropped releases.

What

• Artifact transfers retry once. This covers every build upload (artifact, win-x64 symbols) and every test/release download. The first attempt is continue-on-error; after a 45 s pause the second attempt is the verdict.
  • Upload retries use overwrite: true under the same name, because downstream jobs download by exact name.
  • The retries are inline steps, not a local composite action: the publish jobs have no checkout, and adding one to ~90 cells would introduce a new failure point of the same kind.
• publish-ios upload and SHA256SUMS now get the same bounded 6-attempt retry the desktop publish upload already had. --clobber keeps both idempotent. A failed manifest generation never uploads, because the upload is gated with &&.
• release.yml concurrency now uses queue: max. Up to 100 releases can wait, and they run in order.
• Comments that said the release is public while assets upload are corrected. The release is a draft until finalize, which gates on every upload and on the manifest.

Verification

• queue: max: actionlint 1.7.12 rejects the key (rhysd/actionlint#654), and an invalid release.yml would stop releases. So I confirmed GitHub accepts it with a throwaway branch and probe workflow, which passed; both are deleted. GitHub's workflow-syntax docs also document it. The repo's CI does not run actionlint.
• actionlint: no other findings on the four changed workflows.
• Repo gates: image-pins-test, select-versions-test and matrix-consistency-test pass.
• Codex: approved the plan with changes; this is the artifact-transfer part of it. Its code review verdict was SHIP with no findings. It checked the retry conditions and outcomes, that diagnostics uploads still fire, the default shell for sleep on every host and container, and the exit paths of both retry loops.

The workflow edits select no FFmpeg versions, so merging this cuts no release. Ordinary green CI also doesn't exercise the retry paths; they only run when a transfer actually fails.

Follow-up (separate PR, design under review):

• Releases that repair themselves: rebuild any line whose inputs changed since its last published release.
• A rerun-safe release job.
• One automatic re-run of failed jobs.

🤖 Generated with Claude Code

[ryan-morris]

Closing: #60 moves this repository to ffmpeg-build, whose release workflow already retries every asset upload (a release stays a draft until all are up) and queues releases instead of dropping them.