[devantler]

🤖 Generated by the Agentic Engineer

Why

Every platform change is checked by a job that downloads two signing and inventory tools from GitHub. When GitHub briefly answers with a server error, as it did repeatedly this afternoon, the job fails outright and blocks unrelated changes; the production deploy installs the same tools and would fail the same way.

What

The downloads now retry a few times before giving up. The downloaded tools are still checked against the exact versions we reviewed, and a download that keeps failing still stops the job.

Fixes #4023

[devantler]

🤖 Generated by the Agentic Engineer

Tried as a user. Ran the exact new download command (same flags, including --retry 5 --retry-delay 3) with the real curl against the pinned syft 1.51.1 release asset: exit 0, and the bytes match the reviewed SHA-256 pin. The retry path itself is curl's own behaviour on timeouts, 408, 429 and 5xx, so it is asserted rather than reproduced: the installer test now fails on main (download does not retry transient failures) and passes here, and its existing checks still prove a persistent download failure is refused with nothing installed.

Evidence for the fix: the failing step on #4020 and #4022 (and #4022's re-run) was curl: (22) The requested URL returned error: 504 in this installer.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

@devantler: I will perform a full review of #4024.

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 33 minutes.

[coderabbitai]

Warning

Review limit reached

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5fec6727-d059-4015-895a-60e6deacf4c5

📥 Commits

Reviewing files that changed from the base of the PR and between 398297c and f92770f.

📒 Files selected for processing (2)

• .github/scripts/setup-supply-chain-tools.sh
• scripts/tests/test-setup-supply-chain-tools.sh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

CodeRabbit refused this head (rate limited) and Codex is at its usage limit, so this round advances to Bugbot.

[devantler]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f92770f. Configure here.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at f92770f: all checks green, including 🧪 Validate Manifests running the changed installer; Cursor Bugbot green at this head with no findings (CodeRabbit refused this round on its hourly limit, Codex at its usage limit); 0 threads; tried as a user per the comment above. Promoting and adding to the merge queue.