From 8135e0f3aca3e0c878d74d5eceeaaf5db442e046 Mon Sep 17 00:00:00 2001 From: James Maes Date: Wed, 3 Jun 2026 15:46:22 -0500 Subject: [PATCH] ci(workbench): retry helm chart publish on flaky ghcr.io DNS helm job failed on 'dial tcp: lookup ghcr.io ... i/o timeout' (transient runner DNS), not a code issue. Retry login+push 3x with backoff; switch to --password-stdin (CLI -p warned insecure). Deploy is unaffected (separate job). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9adc48b..2731a25 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -289,11 +289,26 @@ jobs: REGISTRY_USER: ${{ github.actor }} REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | + set -euo pipefail helm package deploy/helm/benchfinity \ --version "${CHART_VERSION}" \ --app-version "${CHART_VERSION}" - helm registry login ghcr.io -u "${REGISTRY_USER}" -p "${REGISTRY_TOKEN}" - helm push "benchfinity-${CHART_VERSION}.tgz" oci://ghcr.io/benchfinity/charts + + # Retry login+push: ghcr.io DNS/network is intermittently flaky on + # runners ("dial tcp: lookup ghcr.io ... i/o timeout"). Use + # --password-stdin (CLI -p is insecure and warned). + for attempt in 1 2 3; do + if printf '%s' "${REGISTRY_TOKEN}" \ + | helm registry login ghcr.io -u "${REGISTRY_USER}" --password-stdin \ + && helm push "benchfinity-${CHART_VERSION}.tgz" oci://ghcr.io/benchfinity/charts; then + echo "Chart pushed on attempt ${attempt}." + exit 0 + fi + echo "helm publish attempt ${attempt} failed; retrying in $((attempt * 10))s..." + sleep $((attempt * 10)) + done + echo "::error::helm chart publish failed after 3 attempts." + exit 1 deploy: name: deploy