fix(ci): make tests, workflows, and attribution reliable under load

[teknium1]

Summary

CI now self-heals one-off test-file flakes, eliminates the known timing/env races, retries transient external I/O, bounds every workflow job, restores duration-balanced shards, and maps contributor emails without a shared-file merge-conflict hotspot.

Root causes were tight loaded-runner timing assumptions, sleep-based synchronization, environment/config leakage, un-retried registries/APIs, a duration cache that never restored, and every salvage PR appending to the same 1,900-line AUTHOR_MAP dict.

Changes

• Test runner: retry a failed test file once in a fresh process; pass-on-retry stays green but prints ⚠ FLAKY with both complete attempts. Deterministic failures remain red. New behavior tests cover both paths.
• Test suite: replace timer/sleep races with Events/state polling, widen loaded-runner timing margins, stop deferred TUI agent timers leaking into the next test, and isolate Honcho/provider/SSH environment state.
• CI workflows: add timeout-minutes to every job, bounded retries around network installs/API label gates/Docker manifest publication, working duration-cache restore keys, and non-blocking advisory artifact uploads.
• Docker build: retry APT, npm, Playwright, s6-overlay downloads, and Docker Hub eventual-consistency failures while retaining checksum verification.
• Contributor attribution: freeze the legacy map and add conflict-free contributors/emails/<email> mapping files plus scripts/add_contributor.py; CI accepts either source and gives the exact remediation command.

Validation

Check	Result
Full Python suite	2,060 files / 42,475 passed / 0 failed
Flake found by new retry	Honcho async writer busy-poll race; replaced with Events, then 30/30 passes under 15-way contention
Full JS/TS workspace check	Typechecks, Vitest suites, desktop package/build, TUI, web: green
Critical post-rebase subset	561 passed / 0 failed
Attribution tests	12 passed plus subprocess E2E
Quality gates	Ruff green, Windows-footgun scan green, all workflow/action YAML parsed

Infographic

[ethernet8023]

Code Review: retry patterns vs .github/actions/retry

I went through every retry mechanism this PR adds and checked each one against the reusable .github/actions/retry composite action. Here's the full inventory:

✅ Already converted to the composite action (correct)

File	Step	Command
docker.yml:129	Install Python deps	uv sync --locked --python 3.11 --extra dev
upload_to_pypi.yml:58	Build web dashboard	npm ci (web)
upload_to_pypi.yml:61	Build TUI bundle	npm ci (ui-tui)
deploy-site.yml:67	Install PyYAML	pip install pyyaml==6.0.2 httpx==0.28.1
deploy-site.yml:154	Install deps	npm ci (website)
skills-index.yml:31	Install deps	pip install httpx==0.28.1 pyyaml==6.0.2

These are the textbook fit: single command, retry on non-zero exit, fail hard. The PR correctly split the combined cd web && npm ci && npm run build into a retried npm ci step + a separate npm run build step — nice touch, build shouldn't be retried.

✅ Correct to keep as curl --retry flags (not composite-action candidates)

• deploy-site.yml:47 — curl -fsS --retry 3 --retry-delay 10 (Vercel webhook POST)
• skills-index-freshness.yml:31 — curl -fsSL --retry 3 --retry-delay 10 (index probe)
• Dockerfile — curl -fsSL --retry 3 (s6-overlay tarballs)

curl's native --retry is the right tool for single curl invocations — it retries on transient HTTP errors and connection failures without wrapping a whole step.

✅ Correct to keep as inline loops (cannot use composite action)

Each of these has a structural reason the composite action can't handle:

1. detect-changes/action.yml:65 — gh api compare call

• Captures output into $CHANGED shell variable consumed later in the same step
• Failure mode is fail-open (warn + empty = all lanes run), not hard-fail. The composite action always exits 1 on final failure.

2. docker.yml:221 — docker buildx imagetools create

• Depends on ${tags[@]} and ${args[@]} shell arrays built conditionally earlier in the same run: script
• Can't be a separate step — the arrays don't survive step boundaries

3. lint.yml:191 — gh pr view label fetch

• Captures output into $LABELS, consumed inline by grep -Fxq in the same step

4. supply-chain-audit.yml:250 — gh pr view label fetch

• Identical pattern to lint.yml

5. uv-lockfile-check.yml:76 — uv lock --check

• On final failure, writes a detailed remediation guide to $GITHUB_STEP_SUMMARY then exits 1 — the composite action can't do custom failure paths

6. upload_to_pypi.yml:135 — gh release view poll loop

• This is polling for existence (30 attempts, 10s apart), not retry-on-failure
• On timeout, sets skip_sign=true in $GITHUB_ENV and continues — not a hard failure

⚠️ Minor observations

• lint.yml and supply-chain-audit.yml label-fetch loops are copy-pasted. The retry logic is identical. If we ever want to DRY this, a small composite action like .github/actions/gh-pr-labels/ that outputs the label list would work — but that's a follow-up, not a blocker. The current duplication is only ~12 lines × 2.

• Dockerfile playwright loop (line 136) uses a compact one-liner for i in 1 2 3; do ... && break || { ... }; done — slightly harder to read than the multi-line pattern used elsewhere, but functionally equivalent and correct.

Verdict

No changes needed. The PR already converted every convertible retry to the composite action, and correctly left the rest as inline loops or curl flags where they belong. The retry action's design (run command → retry on non-zero → hard-fail) simply can't express output-capture, fail-open, custom-failure-path, or polling semantics, and all the remaining inline loops need one of those.

---

Reviewed by Hermes Agent (ethie)

[github-actions]

✅ CI-sensitive file review passed

The ci-reviewed label is present on this PR.