From dfa4aba8b0a0acf1ca91e6506b4dfa175499b065 Mon Sep 17 00:00:00 2001
From: jonahgabriel <jonahgabriel@users.noreply.github.com>
Date: Sun, 28 Jun 2026 03:47:49 -0400
Subject: [PATCH] =?UTF-8?q?fix(OMN-13687):=20bounded=20retry=20on=20docker?=
 =?UTF-8?q?=20push=20to=20ECR=20=E2=80=94=20absorb=20transient=20runner?=
 =?UTF-8?q?=E2=86=92ECR=20EOF=20(emergency=20prod=20recovery)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-and-push-runtime.yml | 36 +++++++++++++++++++-
 1 file changed, 35 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-and-push-runtime.yml b/.github/workflows/build-and-push-runtime.yml
index f5da8a4af9..1a3211c728 100644
--- a/.github/workflows/build-and-push-runtime.yml
+++ b/.github/workflows/build-and-push-runtime.yml
@@ -192,12 +192,46 @@ jobs:
       - name: Push image to Amazon ECR
         if: success()
         shell: bash
+        env:
+          # OMN-13687: bounded retry config for the docker push. Mirrors the
+          # exponential-backoff idiom in .github/actions/resolve-ecr-digest.
+          PUSH_MAX_ATTEMPTS: '5'
+          PUSH_INITIAL_DELAY: '10'
+          PUSH_MAX_DELAY: '120'
+          PUSH_BACKOFF_FACTOR: '2'
         run: |
           echo "Trivy scan passed — pushing image to ECR..."
+          # OMN-13687: wrap `docker push` in a bounded retry loop to absorb the
+          # transient network EOF on a blob HEAD seen on the .201 self-hosted
+          # runner -> ECR path. Additive only: image tags and digest
+          # computation are unchanged; this only retries the network push.
+          push_with_retry() {
+            local tag="$1"
+            local delay="$PUSH_INITIAL_DELAY"
+            local attempt
+            for attempt in $(seq 1 "$PUSH_MAX_ATTEMPTS"); do
+              echo "Attempt ${attempt}/${PUSH_MAX_ATTEMPTS}: docker push ${tag}"
+              if docker push "${tag}"; then
+                echo "Pushed ${tag} on attempt ${attempt}"
+                return 0
+              fi
+              if [[ "${attempt}" -lt "$PUSH_MAX_ATTEMPTS" ]]; then
+                echo "::warning::push attempt ${attempt} for ${tag} failed; retrying in ${delay}s..."
+                sleep "${delay}"
+                delay=$((delay * PUSH_BACKOFF_FACTOR))
+                if [[ "${delay}" -gt "$PUSH_MAX_DELAY" ]]; then
+                  delay="$PUSH_MAX_DELAY"
+                fi
+              fi
+            done
+            echo "::error::docker push ${tag} failed after ${PUSH_MAX_ATTEMPTS} attempts"
+            return 1
+          }
+
           IFS=',' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
           for TAG in "${TAGS[@]}"; do
             echo "Pushing: ${TAG}"
-            docker push "${TAG}"
+            push_with_retry "${TAG}"
           done
           echo "All tags pushed successfully"