From eb65c1def7c3a47536d789c63bdc8fd38034e4eb Mon Sep 17 00:00:00 2001
From: Christoph Brandau <c.brandau91@gmail.com>
Date: Tue, 4 Aug 2026 22:23:50 +0200
Subject: [PATCH] fix(workflows): improve AUR SSH key handling and clone/push
 retries

This update enhances the workflow for interacting with the AUR by
adding robust error handling for SSH key retrieval and repository
cloning/pushing. It implements retry logic with exponential backoff
for both SSH host key retrieval and git operations, improving
resilience against transient network issues.

- Added retries for SSH key retrieval with exponential backoff
- Implemented retry logic for cloning and pushing to AUR repository
- Ensured script exits gracefully with error messages on failure
---
 .gitea/workflows/app_builder.yaml | 66 +++++++++++++++++++++++++++----
 1 file changed, 59 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/app_builder.yaml b/.gitea/workflows/app_builder.yaml
index cf2b9b5..e00424c 100644
--- a/.gitea/workflows/app_builder.yaml
+++ b/.gitea/workflows/app_builder.yaml
@@ -241,6 +241,8 @@ jobs:
           AUR_GIT_NAME: ${{ vars.USERNAME_GIT }}
           AUR_GIT_EMAIL: ${{ vars.EMAIL_GIT }}
         run: |
+          set -euo pipefail
+
           if [ -z "$AUR_SSH_PRIVATE_KEY" ]; then
             echo "AUR_SSH_PRIVATE_KEY is required" >&2
             exit 1
@@ -249,13 +251,48 @@ jobs:
           install -d -m 0700 "$HOME/.ssh"
           printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur"
           chmod 0600 "$HOME/.ssh/aur"
-          ssh-keyscan -H aur.archlinux.org >> "$HOME/.ssh/known_hosts"
-          chmod 0600 "$HOME/.ssh/known_hosts"
-          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes"
 
-          AUR_CHECKOUT="$(mktemp -d)/gitty-desktop"
-          git -c init.defaultBranch=master clone \
-            ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CHECKOUT"
+          AUR_RETRY_DELAYS=(30 60 120 240)
+          AUR_KNOWN_HOSTS_TEMP="$(mktemp)"
+          AUR_HOST_KEY_READY=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR host-key attempt $AUR_ATTEMPT of 5"
+            if timeout 30s ssh-keyscan -T 15 -H aur.archlinux.org > "$AUR_KNOWN_HOSTS_TEMP" \
+              && [ -s "$AUR_KNOWN_HOSTS_TEMP" ]; then
+              AUR_HOST_KEY_READY=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_HOST_KEY_READY" -ne 1 ]; then
+            echo "Could not retrieve the AUR SSH host key after 5 attempts" >&2
+            exit 1
+          fi
+          install -m 0600 "$AUR_KNOWN_HOSTS_TEMP" "$HOME/.ssh/known_hosts"
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=30 -o ServerAliveInterval=15 -o ServerAliveCountMax=2"
+
+          AUR_CHECKOUT_ROOT="$(mktemp -d)"
+          AUR_CHECKOUT=""
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            AUR_CLONE_CANDIDATE="$AUR_CHECKOUT_ROOT/attempt-$AUR_ATTEMPT"
+            echo "AUR clone attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git -c init.defaultBranch=master clone \
+              ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CLONE_CANDIDATE"; then
+              AUR_CHECKOUT="$AUR_CLONE_CANDIDATE"
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR is unavailable; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ -z "$AUR_CHECKOUT" ]; then
+            echo "Could not clone the AUR repository after 5 attempts" >&2
+            exit 1
+          fi
+
           cp "$AUR_SOURCE_DIR/PKGBUILD" "$AUR_SOURCE_DIR/.SRCINFO" "$AUR_CHECKOUT/"
 
           cd "$AUR_CHECKOUT"
@@ -269,7 +306,22 @@ jobs:
           fi
 
           git commit -m "Update to $PACKAGE_VERSION"
-          git push origin HEAD:master
+          AUR_PUSHED=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR push attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git push origin HEAD:master; then
+              AUR_PUSHED=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR push failed; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_PUSHED" -ne 1 ]; then
+            echo "Could not publish to AUR after 5 attempts" >&2
+            exit 1
+          fi
 
   publish-ubuntu:
     name: Build and publish Ubuntu AppImage