fix(download): enforce three total attempts

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+- Added provider derivative `v0.1.5-nddev.78`: runner metadata bootstrap uses
+  the same three-total-attempt download contract as every other reviewed
+  network artifact path.
+
 - Added provider derivative `v0.1.5-nddev.77`: undeclared pool reservations
   now use hard CPU and memory limits, removing implicit overcommit from queue
   accounting and per-member placement while retaining explicitly reviewed
@@ -76,6 +80,10 @@ Versioning.
 
 ### Fixed
 
+- Bound every reviewed `curl` download path to two retries after the initial
+  request, making the repository-wide download policy exactly three total
+  attempts while leaving service-readiness polling and provider state retries
+  under their separate typed deadlines.
 - Default undeclared queue reservations to each pool's hard CPU and memory
   limits instead of silently applying a global historical overcommit table;
   smaller measured envelopes now require an explicit reviewed pool field.

actions/tool-cache/tool-cache.sh

@@ -108,7 +108,7 @@ fi
 if [[ "$source" == upstream ]]; then
   rm -f -- "$candidate"
   curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
-    --retry 5 --retry-all-errors --retry-max-time 180 --connect-timeout 15 --max-time 300 \
+    --retry 2 --retry-all-errors --retry-max-time 180 --connect-timeout 15 --max-time 300 \
     --max-filesize "$max_bytes" \
     --output "$candidate" "$url"
   if ! verify_candidate; then

config/example-runner-1.yaml

@@ -9,7 +9,7 @@ control_plane:
   manager_version: v0.2.1-nddev.80
   scheduling_mode: scale-set
   provider: incus
-  provider_version: v0.1.5-nddev.77
+  provider_version: v0.1.5-nddev.78
   provider_interface: v0.1.0
   worker_kind: incus-container
   runner: actions/runner

config/example-runner-2.yaml

@@ -9,7 +9,7 @@ control_plane:
   manager_version: v0.2.1-nddev.80
   scheduling_mode: scale-set
   provider: incus
-  provider_version: v0.1.5-nddev.77
+  provider_version: v0.1.5-nddev.78
   provider_interface: v0.1.0
   worker_kind: incus-container
   runner: actions/runner

config/example-runner-3.yaml

@@ -9,7 +9,7 @@ control_plane:
   manager_version: v0.2.1-nddev.80
   scheduling_mode: scale-set
   provider: incus
-  provider_version: v0.1.5-nddev.77
+  provider_version: v0.1.5-nddev.78
   provider_interface: v0.1.0
   worker_kind: incus-container
   runner: actions/runner

config/example-runner-4.yaml

@@ -9,7 +9,7 @@ control_plane:
   manager_version: v0.2.1-nddev.80
   scheduling_mode: scale-set
   provider: incus
-  provider_version: v0.1.5-nddev.77
+  provider_version: v0.1.5-nddev.78
   provider_interface: v0.1.0
   worker_kind: incus-container
   runner: actions/runner

config/example-services.yaml

@@ -27,7 +27,7 @@ control_plane:
   manager_version: v0.2.1-nddev.80
   scheduling_mode: scale-set
   provider: incus
-  provider_version: v0.1.5-nddev.77
+  provider_version: v0.1.5-nddev.78
   provider_interface: v0.1.0
   worker_kind: incus-container
   runner: actions/runner

config/provider-derivative.yaml

@@ -16,7 +16,7 @@ artifact: garm-provider-incus
 # state all move together, because all three derive from here. A provider change
 # that does not bump it ships under the previous version, which is exactly how
 # runner-1 and runner-2 diverged.
-derivative_version: v0.1.5-nddev.77
+derivative_version: v0.1.5-nddev.78
 
 # The external-provider protocol GARM speaks to this binary. It moves on its own
 # schedule -- a provider release does not imply an interface release -- so it is
@@ -37,8 +37,8 @@ runtime:
   queue_intent_schema_version: 4
 
 build:
-  source_commit: b9937e043eb0f9e4ce62b531cc0ee421ca382f21
-  binary_sha256: 965d39a69654180c3d91b9c92d2e8a6b41ca96a056416aed9656409aed209990
+  source_commit: f8a91e798f58ca71bcf0204854d387a228262a5c
+  binary_sha256: 204e3e1a4a4e9b9beeb3516fb8921e58fe9b2f928ed70404a8bdd4497ee0ade2
   go_version: go1.26.6
   cgo_enabled: false
   target_os: linux

internal/garmproviderincus/provider/incus.go

@@ -999,7 +999,7 @@ if [[ -n "${CA_B64}" ]]; then
   test -s "${ca_file}"
   export CURL_CA_BUNDLE="${ca_file}"
 fi
-curl -H "Authorization: Bearer ${BEARER_TOKEN}" --retry 5 --retry-delay 5 --retry-connrefused --fail "${METADATA_URL}/install-script/" -o "${install_script}"
+curl -H "Authorization: Bearer ${BEARER_TOKEN}" --retry 2 --retry-delay 5 --retry-connrefused --fail "${METADATA_URL}/install-script/" -o "${install_script}"
 chmod 0700 "${install_script}"
 # GARM's pinned runtime wrapper enables xtrace before it invokes the generated
 # installer. Keep tracing output on an already-open /dev/null descriptor so a

internal/garmproviderincus/provider/specs.go

@@ -89,7 +89,7 @@ set -o pipefail
 METADATA_URL="{{ .MetadataURL }}"
 BEARER_TOKEN="{{ .CallbackToken }}"
 
-curl -H "Authorization: Bearer $BEARER_TOKEN" --retry 5 --retry-delay 5 --retry-connrefused --fail $METADATA_URL/install-script/ -o /tmp/real-install.sh
+curl -H "Authorization: Bearer $BEARER_TOKEN" --retry 2 --retry-delay 5 --retry-connrefused --fail $METADATA_URL/install-script/ -o /tmp/real-install.sh
 chmod +x /tmp/real-install.sh
 
 /tmp/real-install.sh

internal/garmproviderincus/provider/specs_test.go

@@ -270,7 +270,7 @@ set -o pipefail
 METADATA_URL="https://gateway.example/metadata"
 BEARER_TOKEN="opaque-token"
 
-curl -H "Authorization: Bearer $BEARER_TOKEN" --retry 5 --retry-delay 5 --retry-connrefused --fail $METADATA_URL/install-script/ -o /tmp/real-install.sh
+curl -H "Authorization: Bearer $BEARER_TOKEN" --retry 2 --retry-delay 5 --retry-connrefused --fail $METADATA_URL/install-script/ -o /tmp/real-install.sh
 chmod +x /tmp/real-install.sh
 
 /tmp/real-install.sh

internal/repositorycontract/external_downloads_test.go

@@ -65,13 +65,13 @@ func TestExternalDownloadFallbackMarkersRemainBounded(t *testing.T) {
 	root := toolCacheRepositoryRoot(t)
 	checks := map[string][]string{
 		"actions/tool-cache/tool-cache.sh": {
-			"--retry 5", "verify_candidate", "nddev_tool_cache_event=",
+			"--retry 2", "verify_candidate", "nddev_tool_cache_event=",
 		},
 		"scripts/install-benchmark-toolchain.sh": {
-			"--retry 5", "toolchain SHA-256 mismatch", "rustc 1.97.1",
+			"--retry 2", "toolchain SHA-256 mismatch", "rustc 1.97.1",
 		},
 		"internal/garmproviderincus/provider/incus.go": {
-			"--retry 5", "validateRunnerTool",
+			"--retry 2", "validateRunnerTool",
 		},
 		"internal/imagebuild/artifacts.go": {
 			"attempt <= 3", "http.StatusTooManyRequests", "expectedSHA",

scripts/install-benchmark-toolchain.sh

@@ -23,7 +23,7 @@ download_verified() {
     exit 65
   }
   curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
-    --retry 5 --retry-all-errors --connect-timeout 15 --max-time 300 \
+    --retry 2 --retry-all-errors --connect-timeout 15 --max-time 300 \
     --output "${output}" "${url}"
   chmod 0600 "${output}"
   actual_sha256="$(sha256sum "${output}" | awk '{print $1}')"