fix(ci): allow 90 minutes for ECS runner version resolution

.github/workflows/update-ecs-runner-qwen.yml

@@ -25,7 +25,7 @@ jobs:
     name: 'Resolve version'
     if: "${{ github.repository == 'QwenLM/qwen-code' }}"
     runs-on: 'ubuntu-latest'
-    timeout-minutes: 30
+    timeout-minutes: 100
     outputs:
       version: '${{ steps.version.outputs.version }}'
     steps:
@@ -36,12 +36,16 @@ jobs:
           # npm publishes asynchronously: `npm publish --provenance` returns
           # "Your package is being processed and may take a few minutes to
           # become available", and release.yml dispatches this workflow as soon
-          # as it returns. For v0.22.3 the gap was ~16 minutes (published
-          # 17:14Z, resolvable 17:30Z), so the single un-retried `npm view` this
-          # step used to run 404'd on 3 of the 4 pools and left the fleet split
-          # across two CLI versions until a maintainer noticed. Wait the
-          # registry out rather than losing the race.
-          RESOLVE_TIMEOUT_SECONDS: '1500'
+          # as it returns. The gap grows with the package size and varies
+          # widely: v0.22.3 took ~16 minutes, and v0.23.0 (a ~100 MB main
+          # package) took 55m22s measured end to end (npm accepted the upload
+          # 10:58:30Z, the registry served it 11:53:52Z). The previous 1500s
+          # budget gave up long before that and the run failed with the
+          # package still in flight, leaving the fleet on the old version.
+          # Budget ~1 hour for a main-package release and treat anything past
+          # 90 minutes as anomalous. The wait polls every 30s, so fast
+          # publishes still resolve immediately.
+          RESOLVE_TIMEOUT_SECONDS: '5400'
           RESOLVE_INTERVAL_SECONDS: '30'
         run: |-
           set -euo pipefail
@@ -97,9 +101,22 @@ jobs:
             # package dir (ENOTEMPTY). Clear trash left by crashed installs
             # and retry through the seconds-long race window.
             PKG_DIR='/usr/local/lib/node_modules/@qwen-code'
+            # --prefix pins the install to /usr/local: on the hk-4/hk-5
+            # machines root's npm global prefix is a custom Node directory
+            # (/usr/local/lib/nodejs/node-v22.23.2-linux-x64), so without
+            # it the update landed there while the pool kept resolving the
+            # stale /usr/local/bin/qwen -> /usr/local/lib/node_modules copy.
+            # Some pool machines have no passwordless sudo for the runner
+            # user; fall back to installing as that user, which works when
+            # it owns the prefix.
+            if sudo -n true 2>/dev/null; then
+              INSTALL=(sudo env -u NPM_CONFIG_PREFIX)
+            else
+              INSTALL=(env)
+            fi
             for attempt in 1 2 3; do
               sudo rm -rf "${PKG_DIR}"/.qwen-code-* 2>/dev/null || true
-              if sudo env -u NPM_CONFIG_PREFIX npm install -g --registry=https://registry.npmjs.org "@qwen-code/qwen-code@${VERSION}"; then
+              if "${INSTALL[@]}" npm install -g --prefix /usr/local --registry=https://registry.npmjs.org "@qwen-code/qwen-code@${VERSION}"; then
                 exit 0
               fi
               if [[ "${attempt}" -lt 3 ]]; then
@@ -121,6 +138,18 @@ jobs:
           actual="$("${qwen_path}" --version)"
           echo "qwen path: ${qwen_path}"
           echo "qwen version: ${actual}"
+          if [[ "${actual}" != "${VERSION}" ]]; then
+            # Diagnose where the stale binary comes from before failing:
+            # the install step's npm may write to a different prefix than
+            # the one `command -v` resolves on this pool.
+            echo "--- diagnostics ---"
+            echo "readlink: $(readlink -f "${qwen_path}" 2>/dev/null || echo '(not a link)')"
+            ls -la /usr/local/bin/qwen /usr/bin/qwen 2>/dev/null || true
+            echo "npm prefix (sudo): $(sudo env -u NPM_CONFIG_PREFIX npm prefix -g 2>/dev/null || true)"
+            sudo cat /usr/local/lib/node_modules/@qwen-code/qwen-code/package.json 2>/dev/null | grep '"version"' || true
+            sudo ls /usr/local/lib/node_modules/@qwen-code/ 2>/dev/null || true
+            echo "--- end diagnostics ---"
+          fi
           test "${actual}" = "${VERSION}"
 
   # A failed fleet update is otherwise invisible. `qwen-code-pr-review.yml` and

scripts/tests/update-ecs-runner-qwen-workflow.test.js

@@ -112,7 +112,10 @@ const DEFAULT_JOBS = jobsFixture({
 describe('ECS runner qwen update workflow', () => {
   it('installs without the selected runner npm prefix', () => {
     expect(workflow).toContain('cd "${RUNNER_TEMP:?}"');
-    expect(workflow).toContain('sudo env -u NPM_CONFIG_PREFIX npm install -g');
+    expect(workflow).toContain('INSTALL=(sudo env -u NPM_CONFIG_PREFIX)');
+    expect(workflow).toContain(
+      '"${INSTALL[@]}" npm install -g --prefix /usr/local',
+    );
   });
 
   it('runs only when this workflow changes on main', () => {