CI: retry docker builds on transient registry/network failures.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitea/workflows/ci.yml

@@ -26,24 +26,28 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Build eventhub image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/Dockerfile
-          load: true
-          tags: eventhub:latest
-          provenance: false
-          sbom: false
+        run: |
+          set -euo pipefail
+          bash scripts/retry-docker-build.sh 3 30 -- \
+            docker buildx build \
+              --file docker/Dockerfile \
+              --tag eventhub:latest \
+              --load \
+              --provenance=false \
+              --sbom=false \
+              .
 
       - name: Build API test image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: docker/ApiTests.Dockerfile
-          load: true
-          tags: eventhub-api-tests:latest
-          provenance: false
-          sbom: false
+        run: |
+          set -euo pipefail
+          bash scripts/retry-docker-build.sh 3 30 -- \
+            docker buildx build \
+              --file docker/ApiTests.Dockerfile \
+              --tag eventhub-api-tests:latest \
+              --load \
+              --provenance=false \
+              --sbom=false \
+              .
 
       - name: Run API tests (local CT)
         run: docker run --rm eventhub-api-tests:latest

scripts/publish-ift-aux-images.sh

@@ -20,11 +20,12 @@ publish_image() {
 
   if echo "${FILES}" | grep -qE "${path_pattern}"; then
     echo "== ${name}: rebuild (matched: ${path_pattern})"
-    docker buildx build -f "${dockerfile}" --push \
-      -t "${REGISTRY}/${name}:${TAG}" \
-      -t "${REGISTRY}/${name}:ift" \
-      --provenance=false --sbom=false \
-      "${context}"
+    bash scripts/retry-docker-build.sh 3 30 -- \
+      docker buildx build -f "${dockerfile}" --push \
+        -t "${REGISTRY}/${name}:${TAG}" \
+        -t "${REGISTRY}/${name}:ift" \
+        --provenance=false --sbom=false \
+        "${context}"
     return
   fi
 

scripts/retry-docker-build.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Retry docker/buildx commands on transient network/registry failures.
+# Usage: retry-docker-build.sh [max_attempts] [wait_seconds] -- <command...>
+set -euo pipefail
+
+MAX="${1:-3}"
+WAIT="${2:-30}"
+shift 2
+[[ "${1:-}" == "--" ]] && shift
+
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 [max_attempts] [wait_seconds] -- <command...>" >&2
+  exit 2
+fi
+
+attempt=1
+while true; do
+  echo "== docker build attempt ${attempt}/${MAX}: $*"
+  if "$@"; then
+    exit 0
+  fi
+  code=$?
+  if (( attempt >= MAX )); then
+    echo "== all ${MAX} attempts failed (last exit ${code})"
+    exit "${code}"
+  fi
+  echo "== attempt ${attempt} failed (exit ${code}), retry in ${WAIT}s..."
+  sleep "${WAIT}"
+  attempt=$((attempt + 1))
+done