fix(ci): find the last IndexNow submission through its check run, not the run's job list (#9384)

The indexnow job resolved its diff base by listing each earlier main run's jobs at 100 per page, and GitHub's jobs API answers that page with HTTP 502 for every re-run workflow run. The first release scanned back to such a run and failed the step, so no submission ever recorded a success and every later run would fail the same way.

Look up the one `indexnow` check run per commit instead (small, and it counts every attempt), treat a lookup that errors as no success, and when no success is in view diff from the oldest run in view so URLs no submission ever covered are still sent.

Author: waleedlatif1

.github/workflows/ci.yml

@@ -657,6 +657,7 @@ jobs:
     permissions:
       contents: read
       actions: read
+      checks: read
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
@@ -666,27 +667,31 @@ jobs:
         with:
           bun-version: 1.4.4
 
-      # Diff from the head of the last earlier run whose submission succeeded, not the previous
+      # Diff from the last earlier main commit whose `indexnow` check succeeded, not the previous
       # push: a push that never deployed, or whose submission failed, would otherwise drop its
-      # changed URLs for good. Falls back to the previous push when no such run is in view. The
-      # diff needs only the two trees, so that one commit is fetched alone; an all-zero `before`
-      # (the branch's first push) has no base, which the script skips.
+      # changed URLs for good. The check-runs lookup asks for this one check per commit, so it
+      # stays small and counts every attempt of a re-run; a lookup that errors counts as no
+      # success. With no success in view, the base is the oldest run in view, so URLs that no
+      # submission ever covered are sent now. The diff needs only the two trees, so that one
+      # commit is fetched alone; an all-zero `before` (the branch's first push) has no base,
+      # which the script skips.
       - name: Submit changed URLs to IndexNow
         env:
           GH_TOKEN: ${{ github.token }}
           PUSH_BEFORE: ${{ github.event.before }}
         run: |
           BASE_SHA=""
-          while read -r run_id head_sha; do
-            conclusion="$(gh api --paginate "repos/$GITHUB_REPOSITORY/actions/runs/$run_id/jobs?per_page=100" \
-              --jq '.jobs[] | select(.name == "indexnow") | .conclusion')"
-            if [[ "$conclusion" == "success" ]]; then
+          OLDEST_SHA=""
+          while read -r head_sha; do
+            OLDEST_SHA="$head_sha"
+            if succeeded="$(gh api "repos/$GITHUB_REPOSITORY/commits/$head_sha/check-runs?check_name=indexnow&filter=all" \
+              --jq '[.check_runs[] | select(.conclusion == "success")] | length')" && [[ "$succeeded" -gt 0 ]]; then
               BASE_SHA="$head_sha"
               break
             fi
           done < <(gh api "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs?branch=main&event=push&per_page=30" \
-            --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | \"\\(.id) \\(.head_sha)\"")
-          BASE_SHA="${BASE_SHA:-$PUSH_BEFORE}"
+            --jq ".workflow_runs[] | select(.id < $GITHUB_RUN_ID) | .head_sha")
+          BASE_SHA="${BASE_SHA:-${OLDEST_SHA:-$PUSH_BEFORE}}"
           echo "Submitting URLs changed in $BASE_SHA..$GITHUB_SHA"
           if [[ ! "$BASE_SHA" =~ ^0+$ ]]; then
             git fetch --no-tags --depth=1 origin "$BASE_SHA"