ci: cache the pinned OPA binary and retry its download

.github/actions/build-policy-wasm/action.yaml

@@ -8,6 +8,33 @@ description: >
 runs:
   using: composite
   steps:
+    # build_policy_wasm.sh already prefers a cached binary at .cache/opa/<version>/ before reaching
+    # out to openpolicyagent.org, but nothing ever populated that directory in CI, so every run
+    # depended on that download — and it has repeatedly failed, taking a required job down with it.
+    # Restoring the cache means the fetch is only needed the first time a pinned version is seen.
+    - name: Resolve pinned OPA version
+      id: opa
+      shell: bash
+      env:
+        REPO_ROOT: ${{ github.action_path }}/../../..
+      run: |
+        # Parse rather than source: the script builds the WASM on execution, so sourcing it here
+        # would do the work twice (and before the cache is restored).
+        version="$(sed -n 's/^OPA_VERSION="\${OPA_VERSION:-\([^}]*\)}"/\1/p' "${REPO_ROOT}/script/build_policy_wasm.sh" | head -1)"
+        if [ -z "${version}" ]; then
+          echo "Could not parse the pinned OPA version from script/build_policy_wasm.sh" >&2
+          echo "If the OPA_VERSION line moved, update this step — a wrong cache key silently disables caching." >&2
+          exit 1
+        fi
+        echo "version=${version}" >> "${GITHUB_OUTPUT}"
+        echo "Pinned OPA version: ${version}"
+
+    - name: Cache the pinned OPA binary
+      uses: actions/cache@v4
+      with:
+        path: .cache/opa
+        key: opa-${{ runner.os }}-${{ runner.arch }}-${{ steps.opa.outputs.version }}
+
     - name: Build policy WASM
       shell: bash
       env:

script/build_policy_wasm.sh

@@ -112,12 +112,12 @@ download_opa() {
   url="${OPA_DOWNLOAD_BASE_URL}/${OPA_VERSION}/${asset}"
   sha_url="${url}.sha256"
   echo "Downloading OPA ${OPA_VERSION} from ${url}..." >&2
-  if ! curl -fsSL "${url}" -o "${tmp_bin}"; then
+  if ! curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors "${url}" -o "${tmp_bin}"; then
     echo "Failed to download OPA binary from ${url}." >&2
     print_opa_help "${asset}"
     exit 1
   fi
-  if ! curl -fsSL "${sha_url}" -o "${tmp_sha}"; then
+  if ! curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors "${sha_url}" -o "${tmp_sha}"; then
     echo "Failed to download OPA checksum from ${sha_url}." >&2
     print_opa_help "${asset}"
     exit 1