ci: retry Warp checkout and capture DNS failures

.github/workflows/ci.yml

@@ -887,11 +887,31 @@ jobs:
           fi
 
       - name: Checkout
+        id: checkout
+        continue-on-error: true
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           persist-credentials: false
 
+      # WarpBuild can lose GitHub DNS on an otherwise healthy runner. Retry the
+      # checkout once only after that action fails; healthy jobs still perform
+      # one checkout, and a second failure remains a hard failure with evidence.
+      - name: Retry checkout after transient network failure
+        id: checkout-retry
+        if: steps.checkout.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Diagnose checkout network failure
+        if: steps.checkout.outcome == 'failure' && steps.checkout-retry.outcome == 'failure'
+        run: |
+          scripts/ci/capture-network-diagnostics.sh
+          exit 1
+
       - name: Select Xcode
         run: |
           set -euo pipefail
@@ -996,6 +1016,10 @@ jobs:
               echo "Resolve succeeded but binary artifacts are missing (stale cache); clearing and retrying" >&2
               rm -rf "$SOURCE_PACKAGES_DIR"  # whole dir — resolve will not re-materialize artifacts into a partial tree
             fi
+            # Keep the existing three-attempt policy, but record resolver
+            # state when a package attempt fails so provider incidents are
+            # distinguishable from SwiftPM or cache defects.
+            scripts/ci/capture-network-diagnostics.sh || true
             if [ "$attempt" -eq 3 ]; then
               echo "Failed to resolve Swift packages after 3 attempts" >&2
               exit 1
@@ -2447,11 +2471,31 @@ jobs:
           fi
 
       - name: Checkout
+        id: checkout
+        continue-on-error: true
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: recursive
           persist-credentials: false
 
+      # WarpBuild can lose GitHub DNS on an otherwise healthy runner. Retry the
+      # checkout once only after that action fails; healthy jobs still perform
+      # one checkout, and a second failure remains a hard failure with evidence.
+      - name: Retry checkout after transient network failure
+        id: checkout-retry
+        if: steps.checkout.outcome == 'failure'
+        continue-on-error: true
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Diagnose checkout network failure
+        if: steps.checkout.outcome == 'failure' && steps.checkout-retry.outcome == 'failure'
+        run: |
+          scripts/ci/capture-network-diagnostics.sh
+          exit 1
+
       - name: Prepare isolated admission DerivedData
         run: |
           set -euo pipefail

scripts/ci/capture-network-diagnostics.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -u
+
+# Keep provider/network evidence in the job log without failing the original
+# operation. These commands are intentionally read-only and emit no tokens.
+echo "== network diagnostics (runner=${RUNNER_NAME:-unknown}) ==" >&2
+if command -v scutil >/dev/null 2>&1; then
+  scutil --dns 2>&1 || true
+fi
+if command -v route >/dev/null 2>&1; then
+  route -n get default 2>&1 || true
+fi
+if command -v ifconfig >/dev/null 2>&1; then
+  ifconfig 2>&1 || true
+fi
+if command -v dscacheutil >/dev/null 2>&1; then
+  dscacheutil -q host -a name github.com 2>&1 || true
+fi
+if command -v curl >/dev/null 2>&1; then
+  curl --connect-timeout 5 --max-time 10 --silent --show-error --head https://github.com/ 2>&1 || true
+fi
+echo "== end network diagnostics ==" >&2

scripts/ci/compile-app-host-test-product.sh

@@ -14,6 +14,8 @@
 # another layout cannot hit, so it should be a cache miss and not a download.
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
 usage() {
   echo "usage: $0 fingerprint <derived-data>" >&2
   echo "       $0 resolve <derived-data> <source-packages>" >&2
@@ -51,6 +53,9 @@ resolve() {
       fi
       echo "Resolve succeeded but binary artifacts are missing" >&2
     fi
+    # Preserve resolver evidence for transient WarpBuild failures. Diagnostics
+    # are advisory and never replace the bounded retry below.
+    "$SCRIPT_DIR/capture-network-diagnostics.sh" || true
     [ "$attempt" -lt 3 ] || break
     echo "Package resolution failed on attempt $attempt; clearing packages and retrying" >&2
     rm -rf "$source_packages"