CI: retry docker builds on transient registry/network failures.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/publish-ift-aux-images.sh

@@ -20,11 +20,12 @@ publish_image() {
 
   if echo "${FILES}" | grep -qE "${path_pattern}"; then
     echo "== ${name}: rebuild (matched: ${path_pattern})"
-    docker buildx build -f "${dockerfile}" --push \
-      -t "${REGISTRY}/${name}:${TAG}" \
-      -t "${REGISTRY}/${name}:ift" \
-      --provenance=false --sbom=false \
-      "${context}"
+    bash scripts/retry-docker-build.sh 3 30 -- \
+      docker buildx build -f "${dockerfile}" --push \
+        -t "${REGISTRY}/${name}:${TAG}" \
+        -t "${REGISTRY}/${name}:ift" \
+        --provenance=false --sbom=false \
+        "${context}"
     return
   fi
 

scripts/retry-docker-build.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Retry docker/buildx commands on transient network/registry failures.
+# Usage: retry-docker-build.sh [max_attempts] [wait_seconds] -- <command...>
+set -euo pipefail
+
+MAX="${1:-3}"
+WAIT="${2:-30}"
+shift 2
+[[ "${1:-}" == "--" ]] && shift
+
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 [max_attempts] [wait_seconds] -- <command...>" >&2
+  exit 2
+fi
+
+attempt=1
+while true; do
+  echo "== docker build attempt ${attempt}/${MAX}: $*"
+  if "$@"; then
+    exit 0
+  fi
+  code=$?
+  if (( attempt >= MAX )); then
+    echo "== all ${MAX} attempts failed (last exit ${code})"
+    exit "${code}"
+  fi
+  echo "== attempt ${attempt} failed (exit ${code}), retry in ${WAIT}s..."
+  sleep "${WAIT}"
+  attempt=$((attempt + 1))
+done