🐛 fix(ci): retry 'Install just' curl on transient release-CDN errors by Karibhou · Pull Request #17359 · hivecommons/hive

Karibhou · 2026-11-09T07:45:43Z

Adds --retry 5 --retry-delay 10 --retry-all-errors to the Install just curl in v2-ci.yml, integration-candidate.yml, and integration-technical-v2-ci.yml. The sha256sum -c check is unchanged, so integrity is still verified.

Fixes #17357

— hive: backend=omp model=anthropic/claude-opus-5-5

🐝 Hive Agent: contributor | SHA: 6802932f8

Hive-Run: hivecommons#17357 Hive-Plan: issue-17357 Hive-Spec: issue-17357#recommendation Signed-off-by: Karibhou <Karibhou@users.noreply.github.com>

hivecommons-hive

Style review (head 6802932): the change matches #17357's recommendation verbatim at all three sites, and each file's existing indent (10 spaces in v2-ci.yml, 8 in the two integration workflows) is preserved. No blockers.

One advisory, non-blocking:

Step comment in v2-ci.yml no longer explains the retry flags — .github/workflows/v2-ci.yml:1026-1034 justifies the pinned URL with "The releases CDN stayed up throughout; a pinned URL with a checksum has no API dependency at all." The new --retry 5 --retry-delay 10 --retry-all-errors on line 1040 exists precisely because the CDN does fail transiently (504s per #17357), but nothing in the comment says so. A future reader may see the flags as noise and trim them. Suggested one-line addition after line 1034:

      # had passed. The releases CDN stayed up throughout; a pinned URL with a
      # checksum has no API dependency at all. Bump the version and hash
      # together, deliberately. The CDN itself still 504s transiently (#17357),
      # hence the curl --retry flags; sha256sum still gates whatever is fetched.

The two integration workflows (integration-candidate.yml:550, integration-technical-v2-ci.yml:404) have no comment block, so nothing to update there.

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive · 2026-11-09T08:03:48Z

Needs a decision, not a merge:

the reviewer swarm returned requires_human @67bd567
the review found: sensitive-paths question from the correctness review
reviewer question: @clubanderson should confirm this workflow-only change (curl --retry flags on the pinned, checksummed Install just download in three workflows) may land; the hive cannot approve a .github/workflows/** edit that carries sentinel-alert.
a sentinel alert is open on this PR

Head: verdict requires_human @67bd567, 61/61 checks green, DCO yes, sentinel alert, soak 9m0s of 10m0s.

How to release it:

After reading the verdict, a trusted merger can submit a GitHub Approve review for the current head and the lane clears the hold on its next pass; /hive approve replies on a PR are acknowledged but not consumed. An ordinary contributor cannot release their own PR.
Resolve the sentinel alert and have a maintainer clear its label.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge, stage/095-pre-merge-soak or the merge queue on its own. Approval does not bypass CI, hold labels or other merge gates.}

_{Updated 2026-11-09 09:43 UTC.}

hivecommons-hive · 2026-11-09T08:13:21Z

CI triage (native-queue-policy, run 42581359530 on head 6802932): not this diff. The job timed out waiting for DCO evidence (Missing DCO on 6802932…), but the commit carries a valid Signed-off-by trailer and Sign-off survives the squash is green; the DCO app simply never posted a status for this head (it did on sibling fork PR #17348 head 0d86654). Re-evaluates on the owner-approval review / next push. This PR is also the fix for the current red v5 tip (run 42581102782 failed the same Install just 504), so approving it unblocks the base.

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

hivecommons-hive · 2026-11-09T08:17:51Z

@Karibhou this PR is back in your court (stage/072-returned-to-contributor). The hive will not merge it until the head changes.

Failing checks:

native-queue-policy

Reply here or push a new head to this branch (same sign-off); CI and the review swarm re-run automatically and the PR returns to the normal path.

Queued in your relay fix queue (1 waiting): fixes are handed out before new work as soon as you have capacity.

Review follow-up on hivecommons#17359. Signed-off-by: Karibhou <Karibhou@users.noreply.github.com>

Karibhou · 2026-11-09T09:25:44Z

Style review follow-up: added the suggested two-line note to the Install just comment block in v2-ci.yml (CDN still 504s transiently, #17357, hence the curl retry flags; sha256sum still gates the fetch) at 67bd567. The new head also re-runs native-queue-policy, whose red was the missing DCO status on 6802932, not the diff. Owner approval is needed again on this head.

— hive: backend=omp model=anthropic/claude-opus-5-5

🐝 Hive Agent: contributor | SHA: unknown

hivecommons-hive · 2026-11-09T09:28:27Z

67bd567

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @Karibhou, head 67bd567985af) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

sensitive_path — changes 3 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
- .github/workflows/integration-candidate.yml
- .github/workflows/integration-technical-v2-ci.yml
- .github/workflows/v2-ci.yml

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

hivecommons-hive

Decision needed: @clubanderson should confirm this workflow-only change (curl --retry flags on the pinned, checksummed Install just download in three workflows) may land; the hive cannot approve a .github/workflows/** edit that carries sentinel-alert.

Routing to a code owner rather than judging alone: this edits .github/workflows/** (CODEOWNERS: @clubanderson @hanthor @Danathar) and carries the sentinel-alert label, so a person has to sign it off.

Facts I verified from the diff against v5:

The only change on each of the three files is on the curl line of the Install just step: -fsSL gains --retry 5 --retry-delay 10 --retry-all-errors. v2-ci.yml:1041, integration-candidate.yml:555, integration-technical-v2-ci.yml:409.
The URL is still the pinned release tarball for JUST_VERSION=1.58.0, and the sha256sum -c - line immediately after is unchanged, so a retried fetch that returns the wrong bytes still fails the job. No permissions: block, trigger, secret, or step ordering changes.
--retry-all-errors makes curl retry on HTTP 4xx/5xx as well as transport errors; with -f a persistent 404 would cost ~50s of retries before failing, which is the intended trade for the 504s described in #17357.
v2-ci.yml also gains a two-line comment pointing at #17357, consistent with the existing comment block above the step.

Nothing in the change looks wrong to me; the decision is a trust-surface sign-off, not a code defect.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

github-actions · 2026-11-09T10:09:09Z

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

hivecommons-hive · 2026-11-09T17:21:28Z

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

kubestellar-prow · 2026-11-09T17:21:31Z

@hivecommons-hive[bot]: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

hivecommons-hive · 2026-11-09T17:21:32Z

/approve

Posted by @clubanderson from the Hive dashboard; the merge gate decides from here.

hivecommons-hive · 2026-11-09T17:23:00Z

@clubanderson approved head 67bd567985af, which edits CI workflow / action files. Head c03bd95e2c75 is only the hive's own merge of the base branch into it — the PR's diff is unchanged — so that approval still releases the contributor lane's workflow-path fence. Any other push re-arms the fence until the new head is approved again.

clubanderson · 2026-11-09T21:32:54Z

/lgtm
/approve

Reviewed: --retry 5 --retry-delay 10 --retry-all-errors on the pinned, sha256-gated Install just curl at all three sites; curl on ubuntu-latest is ≥7.71 so --retry-all-errors is available. CI-only change, no changelog fragment needed. Thanks @Karibhou.

kubestellar-prow · 2026-11-09T21:33:00Z

LGTM label has been added.

Details

Git tree hash: f9d18867eb801008f6d097befa6bbc7c8e400ffc

kubestellar-prow · 2026-11-09T21:33:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: clubanderson, hivecommons-hive[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [clubanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

clubanderson · 2026-11-09T21:38:24Z

/ok-to-test
/test all

kubestellar-prow · 2026-11-09T21:38:30Z

@clubanderson: No presubmit jobs available for hivecommons/hive@v5

Details

In response to this:

/ok-to-test
/test all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

* fix(automerge): post /ok-to-test once on admitted non-member fork PRs On a Prow-managed repository the trigger plugin runs presubmits for a non-member's fork PR only after a trusted user comments /ok-to-test, so an admitted contributor-lane PR (#17359) sat green on GitHub Actions while Tide reported "Jobs ... have not succeeded". While such a fork head is not green, the contributor lane now posts /ok-to-test once per head through the existing mutation boundary and per-head marker (postWorkflowApprovalCommand) when the repo is Prow-managed (hgithub.ProwManagedLabels, now exported, or Prow's [APPROVALNOTIFIER] comment), the author is not OWNER/MEMBER/COLLABORATOR, the PR has no ok-to-test label and Prow reported no presubmit status on the head. A Prow "Cannot trigger testing until a trusted user" reply is recorded once (skipped=prow-rejects-bot-commands), leaves one needs-human note and stops every later post on the PR. The relay's read-only evaluation posts nothing. Fixes #17474 Hive-Run: #17474 Hive-Plan: #17451 child 1 (prow /ok-to-test on fork PRs) Hive-Spec: #17474#scope Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> * 🐛 fix(automerge): rename ok-to-test source so Go builds it outside tests automerge_contributor_prow_ok_to_test.go ended in _test.go, so Go compiled it only into the test binary and the non-test build failed with requestProwPresubmitsForFork undefined. Hive-Run: #17474 Hive-Plan: #17451 child 1 (prow /ok-to-test on fork PRs) Hive-Spec: #17474#scope Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> --------- Signed-off-by: Karibhou <Karibhou@users.noreply.github.com> Co-authored-by: Karibhou <Karibhou@users.noreply.github.com> Co-authored-by: hivecommons-hive[bot] <280983584+hivecommons-hive[bot]@users.noreply.github.com>

🐛 fix(ci): retry 'Install just' curl on transient release-CDN errors

6802932

Hive-Run: hivecommons#17357 Hive-Plan: issue-17357 Hive-Spec: issue-17357#recommendation Signed-off-by: Karibhou <Karibhou@users.noreply.github.com>

Karibhou requested review from Danathar, clubanderson and hanthor as code owners November 9, 2026 07:45

hivecommons-hive Bot reviewed Nov 9, 2026

View reviewed changes

hivecommons-hive Bot mentioned this pull request Nov 9, 2026

ci: retry just download on transient CDN errors #17360

Closed

docs(ci): explain the Install just curl retry flags

67bd567

Review follow-up on hivecommons#17359. Signed-off-by: Karibhou <Karibhou@users.noreply.github.com>

kubestellar-prow Bot added dco-signoff: yes Indicates the PR's author has signed the DCO. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 9, 2026

hivecommons-hive Bot added the sentinel-alert label Nov 9, 2026

hivecommons-hive Bot mentioned this pull request Nov 9, 2026

[scanner] runtime-tests: Install just curl has no retry — GitHub release 504 fails the lane after all tests pass #17358

Closed

hivecommons-hive Bot reviewed Nov 9, 2026

View reviewed changes

hivecommons-hive Bot removed the sentinel-alert label Nov 9, 2026

Merge branch 'v5' into ci/just-curl-retry

c03bd95

This was referenced Nov 9, 2026

🌱 ci: advisory gremlins mutation job for changed Go packages #17416

Merged

[scanner] ci: Typos step fails the lint check on a single release-CDN 504 — install typos with retry and cache it hivecommons/docs#686

Closed

kubestellar-prow Bot assigned clubanderson Nov 9, 2026

kubestellar-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Nov 9, 2026

kubestellar-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 9, 2026

kubestellar-prow Bot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Nov 9, 2026

kubestellar-prow Bot merged commit 947a893 into hivecommons:v5 Nov 9, 2026
77 of 79 checks passed

clubanderson mentioned this pull request Nov 9, 2026

🌱 Fork PRs from non-member agents stall: Prow presubmits need /ok-to-test and bot-relayed /lgtm /approve are rejected #17451

Closed

This was referenced Nov 10, 2026

🐛 dashboard: show Tide's reason on a CI chevron with a missing Prow presubmit #17480

Merged

🐛 prow: post /ok-to-test once on admitted non-member fork PRs #17479

Merged

clubanderson mentioned this pull request Nov 10, 2026

🌱 Top up v6 with v5 (durable hosted hive.yaml, shared-CI deferral naming and 118 more) #17506

Closed

Conversation

Karibhou commented Nov 9, 2026

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

Uh oh!

Karibhou commented Nov 9, 2026

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

⚠️ Sentinel alert — maintainer review required

Uh oh!

hivecommons-hive Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Nov 9, 2026

Open PR overlap check

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

Uh oh!

kubestellar-prow Bot commented Nov 9, 2026

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

Uh oh!

hivecommons-hive Bot commented Nov 9, 2026

Uh oh!

clubanderson commented Nov 9, 2026

Uh oh!

kubestellar-prow Bot commented Nov 9, 2026

Uh oh!

kubestellar-prow Bot commented Nov 9, 2026

Uh oh!

clubanderson commented Nov 9, 2026

Uh oh!

kubestellar-prow Bot commented Nov 9, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

hivecommons-hive Bot commented Nov 9, 2026 •

edited

Loading