From bd346ae520fa12da9f03fd9c0395525be83fd6eb Mon Sep 17 00:00:00 2001
From: Joshua Temple <joshua.temple@stablekernel.com>
Date: Thu, 25 Jun 2026 14:18:56 -0400
Subject: [PATCH] fix(fleet): retry repin verify read-back to absorb
 contents-API lag

The repin pushes the rc cli_version to each example repo then reads main back to confirm it landed. The GitHub contents API can serve stale cached bytes for a few seconds after a push, so a single lagged read reds the whole fleet on a random repo each run even though every push succeeded. Retry the verify read with linear backoff (reusing MAX_ATTEMPTS, the same resilience the push loop already has) and only error after all attempts.

Signed-off-by: Joshua Temple <joshua.temple@stablekernel.com>
---
 .github/workflows/fleet-e2e.yaml | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/fleet-e2e.yaml b/.github/workflows/fleet-e2e.yaml
index f3214738..75d60e09 100644
--- a/.github/workflows/fleet-e2e.yaml
+++ b/.github/workflows/fleet-e2e.yaml
@@ -301,17 +301,25 @@ jobs:
           # Confirm the repo's main actually carries the rc cli_version after the
           # push. Belt-and-suspenders: a silent no-op (push that landed nothing)
           # can never report green because this reads the published main back.
+          # The contents API can serve stale cached bytes for a few seconds after
+          # a push, so retry the read-back with linear backoff (matching the push
+          # loop) rather than redding the fleet on a single lagged read.
           verify_pinned() {
-            local slug="$1" actual
-            actual=$(gh api "repos/${slug}/contents/.github/manifest.yaml" \
-              --jq '.content' | base64 -d \
-              | grep -E "^[[:space:]]*cli_version:" | head -n 1 \
-              | sed -E 's|^[[:space:]]*cli_version:[[:space:]]*||' | tr -d '"' | tr -d "'") || return 1
-            if [ "$actual" != "$RC_VERSION" ]; then
-              echo "::error::${slug} main cli_version is '${actual}', expected '${RC_VERSION}'"
-              return 1
-            fi
-            echo "${slug} main verified at ${RC_VERSION}"
+            local slug="$1" actual attempt
+            for attempt in $(seq 1 "$MAX_ATTEMPTS"); do
+              actual=$(gh api "repos/${slug}/contents/.github/manifest.yaml" \
+                --jq '.content' | base64 -d \
+                | grep -E "^[[:space:]]*cli_version:" | head -n 1 \
+                | sed -E 's|^[[:space:]]*cli_version:[[:space:]]*||' | tr -d '"' | tr -d "'") || actual=""
+              if [ "$actual" = "$RC_VERSION" ]; then
+                echo "${slug} main verified at ${RC_VERSION} (attempt ${attempt})"
+                return 0
+              fi
+              echo "verify attempt ${attempt}/${MAX_ATTEMPTS} for ${slug}: read '${actual}', want '${RC_VERSION}'"
+              sleep "$attempt"
+            done
+            echo "::error::${slug} main cli_version is '${actual}', expected '${RC_VERSION}' after ${MAX_ATTEMPTS} attempts"
+            return 1
           }
 
           failed=""