From d86c0485519c76497183ce4ed84d3e86c457cc64 Mon Sep 17 00:00:00 2001 From: Steve Gontzes Date: Thu, 22 Oct 2026 22:11:28 +0000 Subject: [PATCH] Restore default Go vendor mode and retry tool downloads Co-authored-by: c1-squire-dev[bot] --- .github/actions/locked-tools/install-tool.ps1 | 2 +- .github/actions/locked-tools/install-tool.sh | 2 +- .github/workflows/release.yaml | 3 --- docs/release-workflow.md | 14 ++++++++++---- scripts/test-tool-integrity.py | 8 +++++++- 5 files changed, 19 insertions(+), 10 deletions(-) diff --git a/.github/actions/locked-tools/install-tool.ps1 b/.github/actions/locked-tools/install-tool.ps1 index cab9006..f72653d 100644 --- a/.github/actions/locked-tools/install-tool.ps1 +++ b/.github/actions/locked-tools/install-tool.ps1 @@ -40,7 +40,7 @@ $workdir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.Guid]::NewGuid() New-Item -ItemType Directory -Path $workdir | Out-Null try { $archive = Join-Path $workdir 'artifact.zip' - Invoke-WebRequest -Uri $url -OutFile $archive -MaximumRetryCount 3 + Invoke-WebRequest -Uri $url -OutFile $archive -MaximumRetryCount 5 -RetryIntervalSec 2 $actual = (Get-FileHash -Algorithm SHA256 -Path $archive).Hash.ToLowerInvariant() if ($actual -cne $expected) { Write-Host "::error title=locked-tools::$Tool sha256 mismatch" diff --git a/.github/actions/locked-tools/install-tool.sh b/.github/actions/locked-tools/install-tool.sh index a32bee2..50b737d 100755 --- a/.github/actions/locked-tools/install-tool.sh +++ b/.github/actions/locked-tools/install-tool.sh @@ -62,7 +62,7 @@ fi workdir="$(mktemp -d)" trap 'rm -rf "$workdir"' EXIT archive="$workdir/${url##*/}" -curl -sSfL --retry 3 -o "$archive" "$url" +curl -sSfL --retry 5 --retry-delay 2 --retry-all-errors -o "$archive" "$url" if [ "$os" = darwin ]; then if ! printf '%s %s\n' "$expected" "$archive" | shasum -a 256 -c -; then echo "::error title=locked-tools::$tool sha256 mismatch" >&2 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 729dd7f..65f6f19 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -392,9 +392,6 @@ jobs: runs-on: macos-latest-xlarge env: GOTOOLCHAIN: local - GOFLAGS: -mod=readonly - GOPROXY: https://proxy.golang.org - GOSUMDB: sum.golang.org permissions: contents: read id-token: write # <-- needed for cosign keyless (OIDC) diff --git a/docs/release-workflow.md b/docs/release-workflow.md index 2d60455..23e223f 100644 --- a/docs/release-workflow.md +++ b/docs/release-workflow.md @@ -271,10 +271,12 @@ The preflight `_workflows` checkout and local guard always run. Its `go_source_hygiene || go_vulnerability_scan` condition applies to locked-tools, caller checkout, source verification, and the module gate, so disabling both optional checks does not download a Go toolchain. -Tool-using jobs set `GOTOOLCHAIN=local` at job scope. The binaries job also sets -`GOFLAGS=-mod=readonly`, `GOPROXY=https://proxy.golang.org`, and -`GOSUMDB=sum.golang.org` at job scope. Cosign and bundled-buildx/QEMU setup run -after trust/tool bootstrap and before their signing or AWS credentials. +Tool-using jobs set `GOTOOLCHAIN=local` at job scope. Caller builds do not override +`GOFLAGS`, `GOPROXY`, or `GOSUMDB` at workflow/job scope, preserving Go's default +vendor/readonly mode selection and caller proxy configuration. The trusted gon +build retains its separate step-local module and checksum requirements. +Cosign and bundled-buildx/QEMU setup run after trust/tool bootstrap and before +their signing or AWS credentials. ### Locked Release Tools @@ -286,6 +288,10 @@ binaries during extraction. The action's Go assertion and native gon build run after verified installation. Release credentials are configured only after tool installation and checks. Helper code checkouts use `job.workflow_sha`. +Artifact downloads use five retries with a two-second delay; curl retries all +errors, including stream failures. PowerShell uses its native retry count and +interval parameters. The committed SHA256 is still checked before extraction. + Go is installed once per tool-using job, with `GOTOOLCHAIN=local`. Each of the six module gates invokes the checked-out action-local `verify-locked-go.sh` after source verification and receives the installed action's identity: diff --git a/scripts/test-tool-integrity.py b/scripts/test-tool-integrity.py index 271adf3..f25dc7d 100755 --- a/scripts/test-tool-integrity.py +++ b/scripts/test-tool-integrity.py @@ -133,6 +133,7 @@ def test_verified_install_never_invokes_binary(self) -> None: installed = dest / self.archive_member(tool, platform) self.assertTrue(installed.is_file()) self.assertIn(str(installed.parent), self.path_file.read_text().splitlines()) + self.assertIn("--retry 5 --retry-delay 2 --retry-all-errors", self.calls.read_text()) if tool == "go": self.assertIn(f"GOROOT={dest}/go", self.env_file.read_text()) @@ -532,7 +533,8 @@ def test_windows_node_installer_fixture(self) -> None: harness = """ $ErrorActionPreference = 'Stop' function Invoke-WebRequest { - param([string]$Uri, [string]$OutFile, [int]$MaximumRetryCount) + param([string]$Uri, [string]$OutFile, [int]$MaximumRetryCount, [int]$RetryIntervalSec) + if ($MaximumRetryCount -ne 5 -or $RetryIntervalSec -ne 2) { throw 'retry policy mismatch' } Add-Content -LiteralPath $env:CALLS -Value "download $Uri" Copy-Item -LiteralPath $env:ARCHIVE -Destination $OutFile } @@ -641,6 +643,10 @@ def test_release_workflow_has_no_remote_self_actions_or_duplicate_bootstrap(self self.assertNotIn("gon-source.sh", text) for legacy in ("_workflows/scripts/install-tool", "_workflows/scripts/gon-source", "_workflows/scripts/verify-locked-go"): self.assertNotIn(legacy, text) + workflow = json.loads(subprocess.check_output(["yq", ".", str(ROOT / ".github/workflows/release.yaml")], text=True)) + scopes = [workflow.get("env", {})] + [job.get("env", {}) for job in workflow["jobs"].values()] + for env in scopes: + self.assertFalse(set(env or {}) & {"GOFLAGS", "GOPROXY", "GOSUMDB"}) def test_workflow_security_wiring(self) -> None: workflow = json.loads(subprocess.check_output(["yq", ".", str(ROOT / ".github/workflows/release.yaml")], text=True))