Skip to content

ci: retry SBOM generation to fix flaky GitHub 504 failures #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rajnisht7 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: retry SBOM generation to fix flaky GitHub 504 failures #311

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 28 additions & 3 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,42 @@ permissions:
jobs:
sbom:
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

# anchore/sbom-action downloads the pinned Syft release binary from
# github.com's release-asset CDN on every run. That endpoint
# occasionally answers with a transient 504 (seen on run 42567010406:
# "received HTTP status=504 for url=...syft_1.54.0_checksums.txt"),
# which is a GitHub-side blip unrelated to our code or to the pinned
# action/syft versions. Wrap the step in a retry so a single flaky
# download doesn't fail the whole workflow.
- name: Generate SBOM
uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
id: sbom
continue-on-error: true
uses: Wandalen/wretry.action@6feedb7dedadeb826de0f45ff482b53b379a7844 # v3.5.0
with:
format: spdx-json
output-file: sbom.spdx.json
action: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
attempt_limit: 3
attempt_delay: 15000
with: |
format: spdx-json
output-file: sbom.spdx.json

- name: Upload SBOM artifact
if: steps.sbom.outcome == 'success'
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: sbom
path: sbom.spdx.json

# SBOM generation is supply-chain metadata, not a functional gate.
# If GitHub's release CDN is still down after 3 attempts, don't fail
# the push-to-main workflow over it -- just make the miss visible.
- name: Warn if SBOM generation failed
if: steps.sbom.outcome != 'success'
run: |
echo "::warning::SBOM generation failed after retries (likely a transient GitHub release-asset CDN issue). See the 'Generate SBOM' step logs. Not failing the build since SBOM output is non-blocking metadata."
Loading