fix(action): retry transport errors when downloading the release archive - #33
Merged
Conversation
The install step fetched the release archive with `curl -fsSL --retry 3`,
which only retries transient *HTTP* responses (5xx, 408, 429) and timeouts.
A connection reset mid-transfer is a transport-level error, so curl exited
35 immediately without ever using its retry budget:
curl: (35) Recv failure: Connection reset by peer
##[error]Process completed with exit code 35.
That took down an otherwise-green CI run on a consumer's default branch —
nothing was wrong with the repo or its hooks, and a plain re-run went green
with no change. Since this step is pure infrastructure (fetch a tarball,
verify its checksum), an intermittent network fault should cost a retry,
not a red check.
`--retry-all-errors` (curl 7.71+, runners ship 8.x) extends the retry budget
to transport failures, which is the class we actually hit. Retries go 3 -> 5;
curl's backoff doubles from 1s, so the worst case adds ~31s per download
before failing for real, and the checksum verification below is unchanged —
a truncated or corrupt download still fails loudly rather than being retried
into a false pass.
Merged
5 tasks
blairham
added a commit
to pinpredict/.github
that referenced
this pull request
Aug 5, 2026
… main (#51) The push-to-default-branch run gates nothing. Its hook steps already end in `|| true`, and the step that reflects pre-commit's exit code as the job status is `pull_request`-only — the run exists solely to populate the default-branch cache scope so PR branches can restore hook envs. It could still fail on an *infrastructure* step, and did. A transient curl: (35) Recv failure: Connection reset by peer while downloading the go-pre-commit release archive failed the install step and turned an otherwise-green k5s main red (run 30964880559) — test and build both passed, nothing was wrong with the repo or its hooks, and a plain re-run went green with no change. Because callers pin `@main`, that failure mode was reachable from every service repo's default branch. A seed run that fails costs PRs a cold cache, not correctness. That is not worth a red ❌ on a service repo's default branch, so the job is now `continue-on-error` on push. PR runs are deliberately untouched: they keep failing loudly, because that ❌ is what makes the sticky advisory comment worth reading. The root cause is fixed separately in the action itself (blairham/go-pre-commit#33, released as v4.6.1 — `curl --retry` only covers transient HTTP responses and timeouts, never transport errors like a mid-transfer reset). This is the defense-in-depth half: even with retries, an infra step failing on a seed run should not gate anything. Bumping the pinned action version to v4.6.1 is a separate change.
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Add
--retry-all-errors(and raise--retry3 → 5) to the twocurlcalls in the install step.Why
A consumer's CI run failed on its default branch with:
curl --retry Nonly retries transient HTTP responses (5xx, 408, 429) and timeouts. A connection reset mid-transfer is a transport-level error, so curl exits 35 immediately and never touches its retry budget —--retry 3was never going to cover this failure mode.The run was otherwise green (test + build both passed); nothing was wrong with the repo or its hooks, and a plain re-run went green with no change. This step is pure infrastructure — fetch a tarball, verify its checksum — so an intermittent network fault should cost a retry, not a red check on someone's main.
--retry-all-errorsrequires curl 7.71+; GitHub-hosted runners ship 8.x.Notes