fix: retry transient registry uploads

[alongubkin]

Summary

• retry complete OCI image pushes after bounded, structured transport failures
• keep authentication, validation, and local archive failures terminal
• retry manager artifact-registry requests when reqwest reports interrupted request/body transport
• redact signed registry upload URLs from terminal errors

Dockdash is Alien-owned, but no Dockdash change is needed: it already preserves the typed OciDistributionError source and safely supports repeating a whole content-addressed push. The build layer owns the attempt budget, progress output, and final error redaction.

Validation

• cargo test -p alien-build retryable_image_push_detects_interrupted_transport --lib
• cargo test -p alien-build image_push_error_does_not_expose_registry_source_details --lib
• cargo test -p alien-cli artifact_registry_protocol_failures_are_retryable --features platform
• cargo test -p alien-build singlearch_push_produces_single_manifest --lib -- --nocapture against a real disposable local OCI registry

[alongubkin]

@greptileai Please review the current head, including retry boundaries, deterministic failures, credential redaction, and the Dockdash ownership decision.

[alongubkin]

@greptileai Please re-review current head 2b9437b. It now explicitly keeps Dockdash local archive/configuration/I/O errors terminal while retrying only structured network-bearing push failures.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the retries are bounded, cancellation remains effective, and terminal registry errors are sanitized without broadening retries to Dockdash local failures.

Summary

• Retries complete image pushes up to three times with bounded backoff.
• Preserves typed source inspection for transient OCI, reqwest, and network I/O failures.
• Introduces a non-retryable, sanitized IMAGE_PUSH_REJECTED error.
• Adds focused tests for retry classification, local-error exclusion, protocol failures, and signed-URL redaction.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push OCI image] --> B{Push succeeded?}
    B -->|Yes| C[Return success]
    B -->|No| D{Generic error with structured transient source?}
    D -->|Yes, attempts remain| E[Log sanitized retry notice]
    E --> F[Bounded backoff]
    F --> A
    D -->|Yes, budget exhausted| G[Return sanitized IMAGE_PUSH_FAILED]
    D -->|No, Generic registry failure| H[Return sanitized IMAGE_PUSH_REJECTED]
    D -->|No, local/configuration/archive error| I[Return existing terminal Dockdash mapping]

Loading

_{Reviews (2) · Last reviewed commit: "fix: retry transient registry uploads"}