ci: bump install retry from 3 to 5 attempts (Aaron 2026-04-28)

[AceHack]

Summary

Bumps the install-step retry wrapper added in PR #80 from 3 → 5 attempts per Aaron's 2026-04-28 input. Backoff schedule extended from 10s/30s to 10s/30s/60s/120s — covers transient CDN outages from short-burst (~10s recovery) through multi-minute (full 1-2 minute outage).

Why

PR #23's mise+bun-1.3.13 502 burned all 3 of mise's internal retries; a 3-attempt wrapper on top of that didn't add enough margin (3 wrapper × 3 mise = 9 underlying attempts, but they all stacked within a ~30s window where the CDN was still 502'ing).

Aaron explicit: "Mise's internal 3-attempt retry was exhausted on PR #23. go to 5 or 10". Picked 5 (less aggressive, total 5×4=20 underlying attempts spanning ~4 minutes).

Changes

All 3 lint jobs (lint-shell, lint-workflows, lint-markdown):

-          for attempt in 1 2 3; do
+          for attempt in 1 2 3 4 5; do
             if ./tools/setup/install.sh; then exit 0; fi
-            [ "$attempt" = "3" ] && { echo "install.sh failed after 3 attempts"; exit 1; }
-            backoff=$((attempt * 20 - 10))
+            [ "$attempt" = "5" ] && { echo "install.sh failed after 5 attempts"; exit 1; }
+            case "$attempt" in
+              1) backoff=10 ;;
+              2) backoff=30 ;;
+              3) backoff=60 ;;
+              4) backoff=120 ;;
+            esac
             echo "install.sh attempt $attempt failed; retrying in ${backoff}s..." >&2
             sleep "$backoff"
           done

Plus comment update on the lint-shell job documenting the 3 → 5 bump rationale.

Test plan

• All 3 lint-job retry loops updated consistently
• Backoff total: 10+30+60+120 = 220s ≈ 3.7 min — covers most observed CDN outages
• CI passes

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates CI workflows to be more resilient to transient toolchain download failures and to run on a newer Ubuntu runner image.

Changes:

• Increase tools/setup/install.sh retry loop in gate.yml lint jobs to 5 attempts with an explicit 10s/30s/60s/120s backoff.
• Bump several workflows’ runs-on from ubuntu-22.04 to ubuntu-24.04.
• Update/expand workflow comments around the install caching/retry rationale.

Reviewed changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/gate.yml	Updates lint jobs to ubuntu-24.04 and adds/expands install caching + 5-attempt retry/backoff logic.
.github/workflows/scorecard.yml	Runner bump to ubuntu-24.04.
.github/workflows/resume-diff.yml	Runner bump to ubuntu-24.04 and associated comment update.
.github/workflows/memory-index-duplicate-lint.yml	Runner bump to ubuntu-24.04 and associated comment update.
.github/workflows/budget-snapshot-cadence.yml	Runner bump to ubuntu-24.04.

Comments suppressed due to low confidence (6)

.github/workflows/gate.yml:256

• P1: timeout-minutes: 5 is likely too low now that the install step can sleep up to 220s (10+30+60+120) plus the runtime of up to 5 install attempts. If the network is flaky, the job can hit the workflow timeout and lose the intended retry/fail-after-5 behavior; consider increasing the job timeout (or moving retry/backoff into a separate step with its own timeout).

    name: lint (shellcheck)
    timeout-minutes: 5
    runs-on: ubuntu-24.04

.github/workflows/gate.yml:358

• P1: timeout-minutes: 5 may be too low given the new 5-attempt install retry with up to 220s of backoff sleeps (plus install runtimes). Consider increasing the timeout so the retry strategy can actually complete and produce the explicit "failed after 5 attempts" error instead of timing out.

    name: lint (actionlint)
    timeout-minutes: 5
    runs-on: ubuntu-24.04

.github/workflows/gate.yml:523

• P1: With the install step now retried up to 5 times and backoff totaling 220s, timeout-minutes: 5 risks the job timing out before the retry loop completes (especially on cold cache / slow CDN). Bumping the timeout would make the retries effective and preserve the intended failure message.

    name: lint (markdownlint)
    timeout-minutes: 5
    runs-on: ubuntu-24.04

.github/workflows/gate.yml:19

• P1: This comment introduces personal-name attribution ("Aaron" and the task-style "Otto-247") in a workflow file. Repo convention is to use role references on current-state surfaces (like workflows) and keep personal/persona names limited to history surfaces; please rewrite this to use role-refs (e.g., "the human maintainer") and a non-name task reference if needed (see docs/AGENT-BEST-PRACTICES.md:284-346).

#     Lint jobs pinned to ubuntu-24.04 (short-lived, OS-independent
#     work; bumped from 22.04 on 2026-04-28 per Aaron's "we better
#     not be using that old version of ubuntu" + Otto-247 version-
#     currency WebSearch — ubuntu-latest = 24.04 since Jan 2025).

.github/workflows/gate.yml:266

• Typo in quoted text: "dev seutp" should be "dev setup".

        #   "we want to make sure dev seutp and build machine setup

.github/workflows/gate.yml:267

• Grammar/typo: "as close to the same a possible" should be "as close to the same as possible".

        #    are as close to the same a possible"

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db62467258

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep retry budget within lint job timeout

This retry loop now allows five install attempts with 10/30/60/120s backoff, i.e. 220s of sleep before the final try, but the lint jobs still have a 5-minute timeout. That leaves less than 80s total for all install.sh executions, so under the transient CDN failures this change is trying to absorb (where install.sh itself already spends time retrying), the job can time out before attempt 5 is reached. The same pattern is duplicated in lint-workflows and lint-markdown, so the configured “5 attempts” is not reliably achievable unless timeout/backoff are adjusted together.

Useful? React with 👍 / 👎.