Skip to content

fix(ci): retry brief download failures when installing supply-chain tools #4024

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Sep 21, 2026
Merged

fix(ci): retry brief download failures when installing supply-chain tools #4024

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions .github/scripts/setup-supply-chain-tools.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,20 @@ verify_digest() {
fi
}

curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
"https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64" \
--output "${download_dir}/cosign"
# Release downloads retry curl's transient failures (timeouts, 408, 429 and 5xx) a few times,
# because one momentary error from the release host would otherwise fail the job. Every byte
# is still checked against the reviewed pin below, and a persistent failure still stops here.
download() {
curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
--retry 5 --retry-delay 3 "$1" --output "$2"
}

download "https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64" \
"${download_dir}/cosign"
verify_digest cosign "${COSIGN_SHA256}" "${download_dir}/cosign"

curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' \
"https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.tar.gz" \
--output "${download_dir}/syft.tar.gz"
download "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.tar.gz" \
"${download_dir}/syft.tar.gz"
verify_digest syft "${SYFT_SHA256}" "${download_dir}/syft.tar.gz"

# Verify both downloads before extracting or installing either tool. Extract
Expand Down
13 changes: 10 additions & 3 deletions scripts/tests/test-setup-supply-chain-tools.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,16 +25,18 @@ syft_sha=$(sha256sum "${test_root}/fixtures/syft.tar.gz" | cut -d' ' -f1)
cat >"${test_root}/bin/curl" <<'FAKE_CURL'
#!/usr/bin/env bash
set -euo pipefail
url='' output=''
url='' output='' retry=0
while (( $# )); do
case "$1" in
-o|--output) output=$2; shift 2 ;;
--proto|--proto-redir) shift 2 ;;
--retry) retry=$2; shift 2 ;;
--proto|--proto-redir|--retry-delay|--retry-max-time) shift 2 ;;
-*) shift ;;
*) url=$1; shift ;;
esac
done
printf '%s\n' "${url}" >>"${TEST_ROOT}/downloads"
printf '%s %s\n' "${retry}" "${url}" >>"${TEST_ROOT}/retries"
case "${url}" in
https://github.com/sigstore/cosign/releases/download/v9.9.9/cosign-linux-amd64)
[[ ${FAIL_DOWNLOAD:-} != cosign ]] || exit 22
Expand Down Expand Up @@ -85,7 +87,7 @@ make_variant() {
}

run_installer() {
rm -f "${test_root}/installs" "${test_root}/executed" "${test_root}/downloads" "${test_root}/github-path" "${test_root}/installed/"*
rm -f "${test_root}/installs" "${test_root}/executed" "${test_root}/downloads" "${test_root}/retries" "${test_root}/github-path" "${test_root}/installed/"*
status=0
output=$(PATH="${test_root}/bin:${test_root}/installed:${PATH}" \
RUNNER_TEMP="${test_root}/runner" GITHUB_PATH="${test_root}/github-path" \
Expand All @@ -107,6 +109,11 @@ cmp "${test_root}/fixtures/cosign" "${test_root}/installed/cosign" || fail 'wron
cmp "${test_root}/fixtures/syft" "${test_root}/installed/syft" || fail 'wrong syft bytes installed'
grep -Fxq 'cosign version' "${test_root}/executed" || fail 'verified cosign never ran'
grep -Fxq 'syft version' "${test_root}/executed" || fail 'verified syft never ran'
# A transient 5xx from the release host must not fail the job on its first attempt.
[[ $(wc -l <"${test_root}/retries") -eq 2 ]] || fail 'expected exactly two recorded downloads'
while read -r count url; do
[[ ${count} =~ ^[1-9][0-9]*$ ]] || fail "download does not retry transient failures: ${url}"
done <"${test_root}/retries"
if [[ ! -f ${test_root}/github-path ]] || ! grep -Fxq /usr/local/bin "${test_root}/github-path"; then
fail 'subsequent workflow steps can select an unverified tool earlier on PATH'
fi
Expand Down
Loading