[SDK Sentinel] Wait for Nexus update workflow closure

[sdk-sentinel-bot]

Caution

This PR contains untrusted AI-generated code. Do not approve or run CI until a maintainer has reviewed the diff. SDK Sentinel verified that GitHub Actions remained approval-gated with zero executable jobs when this PR was opened.

Summary

• CI evidence: failed CI job · workflow run · first known failure

Prevent an intermittent timeout in the Nexus update-workflow test seen on [Linux ARM](https://github.com/temporalio/sdk-python/actions/runs/33571900335/job/100067454366) and [macOS ARM](https://github.com/temporalio/sdk-python/actions/runs/33565770243/job/100048472237). The bounded window has no preceding equivalent success; the [earliest captured matching failure](https://github.com/temporalio/sdk-python/actions/runs/33528432659) was followed by repeated target-branch failures.

Root cause

The test treated completion of the final update as proof that the target workflow had closed. Those events are not synchronized, so the next update could race workflow closure and remain pending until pytest's 60-second timeout.

Fix

Await the target workflow result before issuing the update whose expected behavior depends on the workflow already being closed.

Validation

The unchanged test did not reproduce in three local repetitions. After the change, ten stress repetitions passed. The fixed repository validator also passed using the preloaded Rust toolchain. Linux ARM and macOS ARM CI remain required because local validation ran on Linux x64.

Validation status: validated-without-reproduction

• Flake confidence: high
• Fix confidence: high
• Value: high
• Patch scope: standard — 1 changed file; 683 B
• Local reproduction: not-reproduced — The unchanged exact test passed three local stress repetitions.
• Regression coverage: pass-after-only — The existing exact test passed ten stress repetitions after adding explicit workflow-closure synchronization.
• Unchanged baseline (Poe lint, bridge lint, and editable build) — passed
• Independent candidate (Poe lint, bridge lint, and editable build) — passed

Investigator-run checks

• poe test -s tests/nexus/test_temporal_operation.py::test_temporal_operation_update_workflow --flake-finder --flake-runs=3 — passed; 1 attempt(s). The unchanged test passed three repetitions; natural reproduction was not observed.
• poe test -s tests/nexus/test_temporal_operation.py::test_temporal_operation_update_workflow --flake-finder --flake-runs=10 — passed; 1 attempt(s). All ten post-change repetitions passed.
• .ci-flake-runtime/input/validate.sh — failed; 1 attempt(s). Lint and type checks passed, but the isolated cache lacked a configured Rust toolchain.
• RUSTUP_HOME=/home/runner/.rustup .ci-flake-runtime/input/validate.sh — passed; 1 attempt(s). The canonical validator passed using the preloaded system Rust toolchain.

Required target CI

• Continuous Integration / build-lint-test (3.14, ubuntu-arm)
• Continuous Integration / build-lint-test (3.10, macos-arm)

Residual risks

• The race did not reproduce locally before the change.
• Post-change stress ran on Linux x64; affected ARM platforms require CI confirmation.

Automation provenance

• Investigator workflow
• Base SHA: d0e075c1e25b3371f0e0f5116d9c6626892e3eab

If this finding should not be fixed, apply the sdk-sentinel:false-positive label and close the PR. Sentinel will suppress the finding until its affected source changes.

SDK Sentinel recurrence history

• Unique failed CI run attempts: 1
• First occurrence: 2026-09-01 23:51 UTC
• Latest occurrence: 2026-09-01 23:51 UTC
• Recent occurrences:
  • 2026-09-01 23:51 UTC — failed CI job