From f139ced35a79ebc347c39b492e6b706809efe1b0 Mon Sep 17 00:00:00 2001 From: mahmutkaya Date: Sun, 6 Sep 2026 03:12:10 +0200 Subject: [PATCH] chore(ci): retry the gitleaks release download on transient 5xx (#177) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A single curl made a REQUIRED check fail in 3s when GitHub's release CDN returned a 504 (run 32473558686, release PR #176) — on a diff that could not possibly contain a secret — and the only recovery was a human re-run. Adds --retry 3 --retry-delay 2 --retry-all-errors to the install step's curl, per the issue. --retry-all-errors is the load-bearing flag: under -f a clean HTTP 504 response exits 22 without being retried by plain --retry. Audit of the sibling pinned-binary installs in this workflow: Trivy (aquasecurity/trivy-action), semgrep (container image), OSV-Scanner (google/osv-scanner-action) and TruffleHog (pinned action) download nothing with curl — the gitleaks step was the only release-tarball download in ci.yml. Same gap exists in security-audit.yml's identical gitleaks install step (out of this PR's stated scope; flagged for a follow-up). Validated: actionlint clean on the workflow; run block bash -n clean. --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a0081d8..6137a06 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -233,9 +233,14 @@ jobs: # Use the binary directly — gitleaks-action requires a paid license # for organizations; the OSS CLI is free under MIT. - name: Install gitleaks + # #177: this curl once 504'd and failed this REQUIRED check in 3s on a + # PR whose diff could not contain a secret (run 32473558686); only a + # human re-run recovered it. `--retry` alone is not enough — under `-f` + # a clean HTTP 504 exits 22 without being retried, so + # `--retry-all-errors` is what actually covers transient 5xx. run: | GITLEAKS_VERSION=8.21.2 - curl -sSfL --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ + curl -sSfL --retry 3 --retry-delay 2 --retry-all-errors --proto '=https' --proto-redir '=https' --tlsv1.2 "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | tar -xzf - -C /tmp gitleaks sudo mv /tmp/gitleaks /usr/local/bin/gitleaks - name: Run gitleaks