Repository navigation
retry cosign - #1714
retry cosign#1714
Conversation
|
👋 skudasov, thanks for creating this pull request! To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team. Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks! |
🦋 Changeset is good to goLatest commit: f82747c We got this. Not sure what this means? Click here to learn what changesets are. |
| # Retry to absorb transient OIDC/Fulcio/Rekor errors. Signing the same | ||
| # digest again is safe: it only adds another signature. | ||
| for (( attempt = 1; attempt <= ATTEMPTS; attempt++ )); do | ||
| if cosign sign "${MANIFEST_NAME_WITH_DIGEST}" --yes; then |
There was a problem hiding this comment.
NIT: do we want to add an exponencial backoff or some delay? trying it in sequence can lead to same fail if underlying service is going through a "hiccup"
There was a problem hiding this comment.
ok. the input already defines it: cosign-sign-retry-interval-seconds
There was a problem hiding this comment.
I think that if cosign will be failing all our attempts we better fail the CI then and look how we can work it around another way (use other tool?). We can't wait an additional 5-10 minutes in CI because it'd be on the path of all the entire auto-CD pipeline in main.
In the scope of https://smartcontract-it.atlassian.net/browse/DX-5631, we've figured out that sometimes the cosign action may fail temporarily https://github.com/smartcontractkit/chipotle/actions/runs/39308447686; hence, this PR adds retries.