From c8560b8d7041766545237ff7b6e2f0bb079e6f87 Mon Sep 17 00:00:00 2001
From: Armin Ronacher <armin.ronacher@active-4.com>
Date: Fri, 17 Jul 2026 10:23:09 +0200
Subject: [PATCH] fix(ai): limit model catalog publication hours

---
 .github/workflows/publish-model-catalog.yml | 36 ++++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish-model-catalog.yml b/.github/workflows/publish-model-catalog.yml
index 4e0abf0a..14571104 100644
--- a/.github/workflows/publish-model-catalog.yml
+++ b/.github/workflows/publish-model-catalog.yml
@@ -13,8 +13,11 @@ on:
       - 'package.json'
       - 'packages/ai/**'
       - 'scripts/publish-model-catalog.mjs'
+  # GitHub schedules use UTC. Run hourly candidates across the CET/CEST
+  # boundaries; the publish job only uploads at 10:17, 12:17, and 14:17
+  # Europe/Vienna time.
   schedule:
-    - cron: '17 */4 * * *'
+    - cron: '17 8-13 * * 1-5'
   workflow_dispatch:
     inputs:
       source_ref:
@@ -103,7 +106,38 @@ jobs:
       - name: Verify AWS CLI
         run: aws --version
 
+      - name: Check publication window
+        id: publication-window
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          MANUAL_PUBLISH: ${{ inputs.publish || false }}
+        run: |
+          set -euo pipefail
+
+          local_day="$(TZ=Europe/Vienna date +%u)"
+          local_hour_text="$(TZ=Europe/Vienna date +%H)"
+          local_hour="$((10#$local_hour_text))"
+          local_time="$(TZ=Europe/Vienna date '+%Y-%m-%d %H:%M:%S %Z')"
+          allowed=false
+          reason="outside the Monday-Friday 10:00-15:00 Europe/Vienna publication window"
+
+          if [[ "$EVENT_NAME" == "workflow_dispatch" && "$MANUAL_PUBLISH" == "true" ]]; then
+            allowed=true
+            reason="manual publication"
+          elif (( local_day <= 5 && local_hour >= 10 && local_hour < 15 )); then
+            if [[ "$EVENT_NAME" != "schedule" ]] || (( (local_hour - 10) % 2 == 0 )); then
+              allowed=true
+              reason="business-hours publication"
+            else
+              reason="not a scheduled 10:17, 12:17, or 14:17 Europe/Vienna publication"
+            fi
+          fi
+
+          echo "allowed=$allowed" >> "$GITHUB_OUTPUT"
+          echo "R2 publication allowed: $allowed ($reason; local time: $local_time)"
+
       - name: Publish model catalog to R2
+        if: steps.publication-window.outputs.allowed == 'true'
         run: |
           node scripts/publish-model-catalog.mjs \
             --input .artifacts/model-catalog \