fix(workflows): improve AUR SSH key handling and clone/push retries

This update enhances the workflow for interacting with the AUR by
adding robust error handling for SSH key retrieval and repository
cloning/pushing. It implements retry logic with exponential backoff
for both SSH host key retrieval and git operations, improving
resilience against transient network issues.

- Added retries for SSH key retrieval with exponential backoff
- Implemented retry logic for cloning and pushing to AUR repository
- Ensured script exits gracefully with error messages on failure

.gitea/workflows/app_builder.yaml

@@ -122,7 +122,6 @@ jobs:
 
   publish-arch:
     name: Build and publish gitty-desktop to AUR
-    needs: publish-windows
     runs-on: archlinux
     environment: production
     env:
@@ -136,11 +135,66 @@ jobs:
       - name: Prepare Arch job container
         working-directory: /
         run: |
-          pacman -Syu --noconfirm
-          pacman -S --needed --noconfirm \
-            base-devel curl git nodejs npm openssh rust \
-            webkit2gtk-4.1 gtk3 hicolor-icon-theme \
+          set -euo pipefail
+
+          # The runner image may contain only a single geo mirror. Seed several
+          # currently active HTTPS mirrors and retain the image's list as a
+          # fallback so one slow CDN cannot fail the complete release.
+          ARCH_MIRROR_BACKUP="$(mktemp)"
+          cp /etc/pacman.d/mirrorlist "$ARCH_MIRROR_BACKUP"
+          printf '%s\n' \
+            'Server = https://frankfurt.mirror.pkgbuild.com/$repo/os/$arch' \
+            'Server = https://mirror.osbeck.com/archlinux/$repo/os/$arch' \
+            'Server = https://mirror.ubrco.de/archlinux/$repo/os/$arch' \
+            'Server = https://ftp.halifax.rwth-aachen.de/archlinux/$repo/os/$arch' \
+            'Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch' \
+            > /etc/pacman.d/mirrorlist
+          sed -n '/^[[:space:]]*Server[[:space:]]*=/p' "$ARCH_MIRROR_BACKUP" \
+            >> /etc/pacman.d/mirrorlist
+
+          ARCH_PACKAGES=(
+            base-devel curl git nodejs npm openssh rust
+            webkit2gtk-4.1 gtk3 hicolor-icon-theme
             libappindicator-gtk3 librsvg xdotool
+          )
+
+          for ARCH_INSTALL_ATTEMPT in 1 2 3; do
+            echo "pacman attempt $ARCH_INSTALL_ATTEMPT of 3"
+            timeout --signal=TERM 30m \
+              pacman -Syu --needed --noconfirm --noprogressbar \
+              "${ARCH_PACKAGES[@]}" \
+              </dev/null &
+            ARCH_PACMAN_PID=$!
+            (
+              ARCH_WAIT_SECONDS=0
+              while true; do
+                sleep 30
+                ((ARCH_WAIT_SECONDS += 30))
+                echo "pacman is still running (${ARCH_WAIT_SECONDS}s elapsed)"
+              done
+            ) &
+            ARCH_HEARTBEAT_PID=$!
+
+            ARCH_PACMAN_STATUS=0
+            wait "$ARCH_PACMAN_PID" || ARCH_PACMAN_STATUS=$?
+            kill "$ARCH_HEARTBEAT_PID" 2>/dev/null || true
+            wait "$ARCH_HEARTBEAT_PID" 2>/dev/null || true
+
+            if [ "$ARCH_PACMAN_STATUS" -eq 0 ]; then
+              break
+            fi
+
+            if [ "$ARCH_PACMAN_STATUS" -eq 124 ]; then
+              echo "pacman attempt timed out after 30 minutes" >&2
+            fi
+
+            if [ "$ARCH_INSTALL_ATTEMPT" -eq 3 ]; then
+              echo "pacman failed after 3 attempts" >&2
+              exit 1
+            fi
+
+            sleep "$((ARCH_INSTALL_ATTEMPT * 5))"
+          done
 
       - uses: actions/checkout@v5
         with:
@@ -187,6 +241,8 @@ jobs:
           AUR_GIT_NAME: ${{ vars.USERNAME_GIT }}
           AUR_GIT_EMAIL: ${{ vars.EMAIL_GIT }}
         run: |
+          set -euo pipefail
+
           if [ -z "$AUR_SSH_PRIVATE_KEY" ]; then
             echo "AUR_SSH_PRIVATE_KEY is required" >&2
             exit 1
@@ -195,13 +251,48 @@ jobs:
           install -d -m 0700 "$HOME/.ssh"
           printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$HOME/.ssh/aur"
           chmod 0600 "$HOME/.ssh/aur"
-          ssh-keyscan -H aur.archlinux.org >> "$HOME/.ssh/known_hosts"
-          chmod 0600 "$HOME/.ssh/known_hosts"
-          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes"
 
-          AUR_CHECKOUT="$(mktemp -d)/gitty-desktop"
-          git -c init.defaultBranch=master clone \
-            ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CHECKOUT"
+          AUR_RETRY_DELAYS=(30 60 120 240)
+          AUR_KNOWN_HOSTS_TEMP="$(mktemp)"
+          AUR_HOST_KEY_READY=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR host-key attempt $AUR_ATTEMPT of 5"
+            if timeout 30s ssh-keyscan -T 15 -H aur.archlinux.org > "$AUR_KNOWN_HOSTS_TEMP" \
+              && [ -s "$AUR_KNOWN_HOSTS_TEMP" ]; then
+              AUR_HOST_KEY_READY=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_HOST_KEY_READY" -ne 1 ]; then
+            echo "Could not retrieve the AUR SSH host key after 5 attempts" >&2
+            exit 1
+          fi
+          install -m 0600 "$AUR_KNOWN_HOSTS_TEMP" "$HOME/.ssh/known_hosts"
+          export GIT_SSH_COMMAND="ssh -i $HOME/.ssh/aur -o IdentitiesOnly=yes -o BatchMode=yes -o ConnectTimeout=30 -o ServerAliveInterval=15 -o ServerAliveCountMax=2"
+
+          AUR_CHECKOUT_ROOT="$(mktemp -d)"
+          AUR_CHECKOUT=""
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            AUR_CLONE_CANDIDATE="$AUR_CHECKOUT_ROOT/attempt-$AUR_ATTEMPT"
+            echo "AUR clone attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git -c init.defaultBranch=master clone \
+              ssh://aur@aur.archlinux.org/gitty-desktop.git "$AUR_CLONE_CANDIDATE"; then
+              AUR_CHECKOUT="$AUR_CLONE_CANDIDATE"
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR is unavailable; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ -z "$AUR_CHECKOUT" ]; then
+            echo "Could not clone the AUR repository after 5 attempts" >&2
+            exit 1
+          fi
+
           cp "$AUR_SOURCE_DIR/PKGBUILD" "$AUR_SOURCE_DIR/.SRCINFO" "$AUR_CHECKOUT/"
 
           cd "$AUR_CHECKOUT"
@@ -215,11 +306,25 @@ jobs:
           fi
 
           git commit -m "Update to $PACKAGE_VERSION"
-          git push origin HEAD:master
+          AUR_PUSHED=0
+          for AUR_ATTEMPT in 1 2 3 4 5; do
+            echo "AUR push attempt $AUR_ATTEMPT of 5"
+            if timeout 3m git push origin HEAD:master; then
+              AUR_PUSHED=1
+              break
+            fi
+            if [ "$AUR_ATTEMPT" -lt 5 ]; then
+              echo "AUR push failed; retrying after backoff"
+              sleep "${AUR_RETRY_DELAYS[$((AUR_ATTEMPT - 1))]}"
+            fi
+          done
+          if [ "$AUR_PUSHED" -ne 1 ]; then
+            echo "Could not publish to AUR after 5 attempts" >&2
+            exit 1
+          fi
 
   publish-ubuntu:
     name: Build and publish Ubuntu AppImage
-    needs: publish-arch
     permissions:
       contents: write
     environment: production

src/App.svelte

@@ -3967,10 +3967,10 @@
       helpOpen = false;
       return;
     }
-    if (event.key === "Escape" && fileHistoryDialogOpen && !isBusy) closeFileHistoryDialog();
+    if (event.key === "Escape" && compareDialogOpen) closeCompareDialog();
+    else if (event.key === "Escape" && fileHistoryDialogOpen && !isBusy) closeFileHistoryDialog();
     else if (event.key === "Escape" && repoTabContextMenu) closeRepoTabContextMenu();
     else if (event.key === "Escape" && pendingDiscard && !isBusy) closeDiscardConfirm();
-    else if (event.key === "Escape" && compareDialogOpen) closeCompareDialog();
     else if (event.key === "Escape" && newBranchCommit) newBranchCommit = null;
     else if (event.key === "Escape" && renameBranchTarget) renameBranchTarget = null;
     else if (event.key === "Escape" && deleteBranchTarget) closeDeleteBranchDialog();

src/app.css

@@ -2882,6 +2882,7 @@
     overflow: hidden;
   }
   .file-history-dialog-backdrop { z-index: 70; }
+  .compare-dialog-backdrop { z-index: 80; }
   .file-history-dialog {
     display: grid;
     grid-template-rows: auto minmax(0, 1fr);

src/lib/components/CompareDialog.svelte

@@ -216,7 +216,7 @@
 </script>
 
 <div
-  class="dialog-backdrop"
+  class="dialog-backdrop compare-dialog-backdrop"
   role="presentation"
 >
   <div class="dialog compare-dialog" role="dialog" aria-modal="true" aria-label="Commit comparison" tabindex="-1">