ci: retry the woke download so a CDN reset cannot fail the gate

[RohanK6]

Problem / Motivation

The Inclusive Language check failed on a PR whose entire diff was one line (layout="side"), containing no flagged terms at all. The scanner never ran — the job died 140ms into the step that downloads the woke binary:

Run asset="woke-${WOKE_VERSION}-linux-amd64.tar.gz"
  curl -sSfL \
    "https://github.com/get-woke/woke/releases/download/v${WOKE_VERSION}/${asset}" \
    -o "$archive"
env:
  WOKE_VERSION: 0.19.0
curl: (35) Recv failure: Connection reset by peer
##[error]Process completed with exit code 35.

curl: (35) is a TLS-layer connection reset from the GitHub Releases CDN. Nothing about it relates to the PR's contents.

Why it matters

• Every PR rolls this dice. One CDN hiccup red-lights an otherwise-green PR on a required check.
• Fork contributors cannot recover cheaply. Re-running a single job needs admin rights (POST /actions/jobs/<id>/rerun → 403 Must have admin rights to Repository). The only contributor-side remedy is an empty amend + force-push, which throws away every other check that already completed in that run and re-queues the entire pipeline.
• The repo already solved this everywhere else. --retry/--retry-delay guard the curl downloads in publish-linux.yml, publish-windows.yml, publish-cli.yml, sign-and-notarize.yml and ship-report.yml. The woke download is the lone outlier.

What changed (motivation → approach → change)

Symptom: a required check fails with no findings and no scanner output. Root cause: .github/workflows/code-review.yml fetches the woke release asset with a bare curl -sSfL and no retry flags, so a single transient reset fails the gate closed.

The change adds the retry flags already conventional in this repo's other release-artifact downloads:

curl -sSfL --retry 3 --retry-delay 2 --retry-all-errors \
  "https://github.com/get-woke/woke/releases/download/v${WOKE_VERSION}/${asset}" \
  -o "$archive"

--retry-all-errors is the load-bearing flag rather than a stylistic addition: a bare --retry covers transient HTTP statuses and timeouts but not a mid-transfer connection reset, which is exactly the exit-35 failure observed. Retries stay bounded at 3 attempts, and -f still fails on HTTP errors.

The integrity gate is deliberately untouched. The existing printf '%s %s\n' "$WOKE_SHA256" "$archive" | sha256sum -c - on the very next line still verifies the payload, so a truncated or substituted download fails loudly instead of being silently retried into a bad binary.

Tests

test/test_github_workflow_security.py already asserted the install step's pinning and checksum properties. This extracts the shared step-slicing into a _woke_install_step() helper and adds test_woke_download_retries_transient_cdn_failures, which locks in:

• all three retry flags are present on the download, so a future edit cannot silently drop them and reintroduce the fail-closed behaviour;
• sha256sum -c - survives alongside the retry, so the ratchet fails if someone ever trades integrity verification for resilience.

Verified the test actually catches the bug: with the workflow hunk reverted to main and the test kept, test_woke_download_retries_transient_cdn_failures fails on assert "--retry 3" in install_step; with the fix applied it passes.

Manual verification

N/A — unit coverage sufficient. The changed surface is a declarative curl invocation whose properties the ratchet test asserts directly; the transient CDN reset that triggered the bug is not reproducible on demand. Local gates run green: 172 tests pass across test_github_workflow_security.py, test_workflow_permissions.py, test_ci_surface_tests.py and test_ai_review_workflows.py; isort and flake8 clean; the workflow YAML parses.

Screenshots / video

Why no screenshot: CI workflow and test-only change — no user-visible surface is touched, so there is no rendered delta to capture.

Related Issues

Fixes #4961

Checklist

• Single commit with a Conventional Commits title (feat|fix|docs|refactor|perf|test|chore|ci|build|revert: ...)
• Existing tests pass and new tests added for new functionality
• Self-review completed; code follows project style guidelines
• Documentation updated (if applicable)
• No secrets, credentials, or internal references in the diff

Note for the maintainer: this diff necessarily touches .github/, so the auto-approval bot will not grant workflow approval — each push needs a manual "Approve and run". That is inherent to the fix, since the bug is in a workflow file.

[github-actions]

Design Review (Fable 5, fork) — ✅ PASS

Design-level review of 003638e62cbdac30b1fb5006a4adb0b67ff250b0 via the fork AI-review pipeline — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

Root-cause fix for a real fail-closed flake, matching the repo's existing curl-retry convention, with the checksum gate preserved and ratchet-tested.

[DESIGN-REVIEWED] 003638e

[github-actions]

Opus 4.8 Review (fork) — ✅ no blocking findings

Reviewed 003638e62cbdac30b1fb5006a4adb0b67ff250b0 via the fork AI-review pipeline; updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 003638e

[github-actions]

GPT 5.6 Review (fork) — ✅ no blocking findings

Reviewed 003638e62cbdac30b1fb5006a4adb0b67ff250b0 via the fork AI-review pipeline; updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 003638e

[github-actions]

First Principles Review (Fable 5, fork) — ✅ PASS

Premise-level review of 003638e62cbdac30b1fb5006a4adb0b67ff250b0 via the fork AI-review pipeline — why this exists and whether the shipped surface is the smallest honest version. Updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Reading the contract, intent, and patch is done; I judged the change against the base tree. Final review:

First-Principles-Verdict: PASS

A one-line retry fix for a reported CI failure (#4961), aimed at the exact curl exit-35 cause, with no riders that add surface.

What this change ships

Intent: stop a transient CDN reset from red-lighting a required PR check whose scanner never ran — a FIX.

1. The woke download now retries up to 3 times, covering connection resets — justified (reported defect, curl exit 35 quoted from the failed run)
2. Explanatory comment on why --retry-all-errors is load-bearing — justified (states a constraint the flags alone don't show)
3. Test file gains _woke_install_step() helper replacing inline slicing — justified (2 consumers, both tests)
4. New ratchet test pinning the retry flags and checksum — justified (same mechanism as the existing pin test in the same file; declared)

Counts run: --retry across .github/workflows/ — 9 existing sites in publish-linux/windows/cli, sign-and-notarize, ship-report, confirming the description's "lone outlier" claim. Unretried-sibling check on the PR-check path: code-review.yml:196 was the only external download in a pull_request-triggered workflow without retry flags (the remaining bare curls hit localhost health endpoints inside their own retry loops, or live in release workflows outside the named harm — a required check a fork contributor cannot re-run). The fix therefore covers all instances of its root cause in scope, sits at cause level (the unretried transfer, not the failing job), and the checksum gate is preserved rather than traded away.

[FIRST-PRINCIPLES-REVIEWED] 003638e