security-audit.yml:82 carries the byte-identical gitleaks install step that #177 fixed in ci.yml: a curl -sSfL download of the release tarball with no retry. A transient 504 exits 22 under -f and fails this required workflow in seconds, with nothing in the diff to blame and only a human re-run to recover it.
Fix: the same flags as #177 — --retry 3 --retry-delay 2 --retry-all-errors (plain --retry is not enough under -f; the 504 exit code is not treated as transient without --retry-all-errors).
Found during #177's sibling audit; it is a different workflow file, so it was deliberately left out of that PR.
security-audit.yml:82carries the byte-identical gitleaks install step that #177 fixed inci.yml: acurl -sSfLdownload of the release tarball with no retry. A transient 504 exits 22 under-fand fails this required workflow in seconds, with nothing in the diff to blame and only a human re-run to recover it.Fix: the same flags as #177 —
--retry 3 --retry-delay 2 --retry-all-errors(plain--retryis not enough under-f; the 504 exit code is not treated as transient without--retry-all-errors).Found during #177's sibling audit; it is a different workflow file, so it was deliberately left out of that PR.