Repository navigation
Conversation
One transient network error on a pinned tool download (a TLS connect failure on kubectl) turned a required check red, because curl tried once and plain --retry does not cover connection errors. Every curl download in the workflows that a SHA-256 check follows now uses one bounded shape: --retry 3 --retry-all-errors --retry-delay 5 --retry-max-time 120, with a per-attempt --max-time (the existing 60 s where set, 120 s otherwise) and a 10 s connect timeout. The checksum lines are unchanged and still run after the download, so a retry covers only the transfer: a file whose checksum fails is neither retried nor accepted. A new contract scans every workflow and composite action for these downloads (44 today, 35 of them kubectl) and refuses one without the bounded retry, with a pipe or a swallowed failure, or with its checksum inside the download statement. It also runs each kubectl download with its real checksum line against a stand-in curl that serves the wrong bytes: the step fails at the checksum after exactly one download, and passes after one when the checksum matches. The alert-routes contract that pins its exact curl arguments is updated in step. Part of #6065 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
✅
|
Contributor
✅
|
Code coverage overviewLanguages: Go Go / code-coverage/go
Line coverage data for the main branch is not yet available. View coverage of the 10 most covered files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Contributor
Author
@coderabbitai review |
Contributor
Action not completed
|
Contributor
|
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Contributor
Author
User trial at
🤖 Generated with Claude Code |
Contributor
Author
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
devantler
marked this pull request as ready for review
November 11, 2026 20:02
devantler
added this pull request to the merge queue
Nov 11, 2026
Any commits made after this event will not be merged.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
When CI downloads one of its pinned tools, a single network hiccup fails the whole required check, because the download is tried only once. Every pull request then needs a manual rerun, and bot updates stop until someone notices.
What
Every pinned tool download in the workflows now tries again a few times, within a fixed time limit, before it gives up. The checksum check that follows each download is unchanged: a file with the wrong checksum still fails the step and is never downloaded again or accepted. A new automated check keeps every such download in this shape.
Part of #6065
🤖 Generated with Claude Code