Unstable download steps - add retry

[max06]

What would you like to be added:
I'd love to see some retry logic around the download steps, especially when using github.com as source.

Why is this needed:
Github.com seems to become less and less stable, due to rising AI traffic (as they proclaimed on X some weeks ago). This causes repeated incidents and smaller, less noticeable issues with the platform. Repeating problems fetching the release list or assets from a repository is just one of the symptoms.

Additional context:

------------------------------ Running SBOM Action -----------------------------
/usr/bin/sh /home/runner/work/_temp/dfa2e940-91ae-4769-82f1-906123bbfeb6 -d -b /home/runner/work/_temp/dfa2e940-91ae-4769-82f1-906123bbfeb6_syft v1.42.3
[info] checking github for release tag='v1.42.3' 
[debug] http_download(url=https://github.com/anchore/syft/releases/v1.42.3) 
Error:  received HTTP status=504 for url='https://github.com/anchore/syft/releases/v1.42.3' 
Error:  unable to find tag='' 
Error:  do not specify a version or select a valid version from https://github.com/anchore/syft/releases 
Error: The process '/usr/bin/sh' failed with exit code 1

keeps bugging us repeatedly since some weeks...

[e2jk]

Ha, funny, I was just about to submit a bug report with that same exact issue, luckily you sent yours 1 minute earlier and I quickly checked if anything had been reported about this.

FWIW, here is the text of the issue I would have submitted:

Description

When GitHub's release CDN returns a transient HTTP 504 during the syft
binary download, the action exits immediately with code 1, failing the
entire CI job. There is no retry logic, so a momentary network hiccup
requires a full manual job re-run.

Steps to reproduce

The failure occurs non-deterministically during syft download. The relevant
log output:

[info] checking github for release tag='v1.42.3'
[debug] http_download(url=https://github.com/anchore/syft/releases/v1.42.3)
Error:  received HTTP status=504 for url='https://github.com/anchore/syft/releases/v1.42.3'
Error:  unable to find tag=''
Error:  do not specify a version or select a valid version from https://github.com/anchore/syft/releases
Error: The process '/usr/bin/sh' failed with exit code 1

Expected behaviour

The action should retry the download (e.g. up to 3 times with a short
delay) before giving up, as transient CDN errors are not indicative of a
real problem with the SBOM generation.

Environment

• anchore/sbom-action v0.24.0
• Runner: ubuntu-latest

[kzantow]

Sorry for the delay getting back to you. We see this intermittently due to github flakiness, I think adding a retry would be ok, but when this error occurs for us, it usually persists for a while, so I'm not sure how helpful it will be. Does this issue persist or has it been resolved at this point?

[max06]

No worries. The issue happens from time to time, and I start to think that a retry would be useless too. We're currently thinking about building our own runner images - does your action skip the download if a/the binary is already there?

[barseghyanartur]

A simple standard config as this would do:

• retry-count
• retry-delay
• optionally retry-backoff

If backed up with proper implementation.