ci: add network retry to all curl/wget/git fetch ops

Random connection/cert errors (e.g. bbg wget failing TLS verify on a bad
edge node) are transient. Add a reusable retry composite action and wire it
into every network operation (up to 5 attempts, 5s backoff, then fail):

- New .github/actions/retry: runs a command, retries on any non-zero exit,
  fails after N attempts.
- bbg (wget|bash) and droidspaces (git clone) -> use retry action.
- setup-build-environment (repo curl + 2 git clones), kernelsu (git
  ls-remote/fetch), susfs-setup (git clone/checkout), btf (dwarves clone)
  -> inline retry() loops.
- curl pipelines (kernelsu setup.sh, commit-status api calls) -> curl
  --retry 5 --retry-delay 5 --retry-all-errors.

No cert bypass: only retries, fails if all attempts fail.

.github/actions/bbg/action.yml

@@ -5,10 +5,13 @@ runs:
   using: composite
   steps:
     - name: Install Baseband Guard
-      shell: bash
-      working-directory: ${{ github.workspace }}/kernel
-      run: |
-        wget -O- https://github.com/vc-teahouse/Baseband-guard/raw/main/setup.sh | bash
+      uses: ./.github/actions/retry
+      with:
+        command: |
+          wget -O- https://github.com/vc-teahouse/Baseband-guard/raw/main/setup.sh | bash
+        attempts: 5
+        delay: 5
+        workdir: ${{ github.workspace }}/kernel
     
     - name: Configure Baseband Guard
       shell: bash

.github/actions/btf/action.yml

@@ -128,7 +128,15 @@ runs:
         # the bundled libbpf/btf_encoder fail under newer GCC as -Werror.
         PAHOLE_SRC="$HOME/dwarves"
         rm -rf "$PAHOLE_SRC"
-        git clone --depth 1 --branch v1.31 https://github.com/acmel/dwarves.git "$PAHOLE_SRC"
+        # Retry transient network errors (up to 5 attempts, 5s backoff).
+        for i in 1 2 3 4 5; do
+          if git clone --depth 1 --branch v1.31 https://github.com/acmel/dwarves.git "$PAHOLE_SRC"; then
+            break
+          fi
+          echo "dwarves clone attempt $i failed; retrying in 5s"
+          rm -rf "$PAHOLE_SRC"
+          sleep 5
+        done
         mkdir -p "$PAHOLE_SRC/build"
         cd "$PAHOLE_SRC/build"
         cmake -D__LIB=lib -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_BUILD_TYPE=Release .. >/dev/null

.github/actions/droidspaces/action.yml

@@ -21,10 +21,13 @@ runs:
   using: composite
   steps:
     - name: Download and Apply Droidspaces-OSS Patches
-      shell: bash
-      working-directory: ${{ github.workspace }}
-      run: |
-        git clone --depth=1 https://github.com/ravindu644/Droidspaces-OSS.git
+      uses: ./.github/actions/retry
+      with:
+        command: |
+          git clone --depth=1 https://github.com/ravindu644/Droidspaces-OSS.git
+        attempts: 5
+        delay: 5
+        workdir: ${{ github.workspace }}
 
     - name: Apply the SYSVIPC kABI fix
       shell: bash

.github/actions/kernelsu/action.yml

@@ -15,6 +15,19 @@ runs:
       run: |
         set -euo pipefail
 
+        # Retry transient network errors (up to 5 attempts, 5s backoff).
+        # Diagnostics go to stderr so pipes to grep are not polluted.
+        retry() {
+          local n=0
+          until [ "$n" -ge 5 ]; do
+            "$@" && return 0
+            n=$((n+1))
+            echo "retry $n/5 failed for: $*" >&2
+            sleep 5
+          done
+          return 1
+        }
+
         KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
         KSU_INPUT="${{ inputs.ksu_branch }}"
         if [ -z "$KSU_INPUT" ]; then
@@ -22,15 +35,15 @@ runs:
         fi
 
         # Try as branch first, fall back to commit
-        if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
+        if retry git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
           echo "Using KernelSU-Next branch: $KSU_INPUT"
-          curl -LSs "https://raw.githubusercontent.com/pershoot/KernelSU-Next/dev-susfs/kernel/setup.sh" | bash -s dev-susfs
-          git -C KernelSU-Next/kernel fetch --depth=50 origin "$KSU_INPUT"
+          curl -LSs --retry 5 --retry-delay 5 --retry-all-errors "https://raw.githubusercontent.com/pershoot/KernelSU-Next/dev-susfs/kernel/setup.sh" | bash -s dev-susfs
+          retry git -C KernelSU-Next/kernel fetch --depth=50 origin "$KSU_INPUT"
           git -C KernelSU-Next/kernel checkout "origin/$KSU_INPUT"
         else
           echo "Using KernelSU-Next commit: $KSU_INPUT"
-          curl -LSs "https://raw.githubusercontent.com/pershoot/KernelSU-Next/dev-susfs/kernel/setup.sh" | bash -s dev-susfs
-          git -C KernelSU-Next/kernel fetch --depth=50 origin "$KSU_INPUT"
+          curl -LSs --retry 5 --retry-delay 5 --retry-all-errors "https://raw.githubusercontent.com/pershoot/KernelSU-Next/dev-susfs/kernel/setup.sh" | bash -s dev-susfs
+          retry git -C KernelSU-Next/kernel fetch --depth=50 origin "$KSU_INPUT"
           git -C KernelSU-Next/kernel checkout "$KSU_INPUT"
         fi
 

.github/actions/retry/action.yml

@@ -0,0 +1,50 @@
+name: 'Retry Command'
+description: 'Run a shell command, retrying up to N attempts with backoff; fails if all attempts fail'
+inputs:
+  command:
+    description: 'Shell command(s) to run'
+    required: true
+  attempts:
+    description: 'Maximum number of attempts (default 5)'
+    required: false
+    default: '5'
+  delay:
+    description: 'Seconds to wait between attempts (default 5)'
+    required: false
+    default: '5'
+  workdir:
+    description: 'Working directory to run in (default: workspace)'
+    required: false
+    default: '${{ github.workspace }}'
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      working-directory: ${{ inputs.workdir }}
+      run: |
+        set -u
+        attempts="${{ inputs.attempts }}"
+        delay="${{ inputs.delay }}"
+
+        cmd() {
+          ${{ inputs.command }}
+        }
+
+        for i in $(seq 1 "$attempts"); do
+          echo "::group::retry attempt $i/$attempts"
+          cmd
+          rc=$?
+          echo "::endgroup::"
+          if [ "$rc" -eq 0 ]; then
+            echo "retry: command succeeded on attempt $i"
+            exit 0
+          fi
+          if [ "$i" -lt "$attempts" ]; then
+            echo "retry: attempt $i failed (rc=$rc); retrying in ${delay}s"
+            sleep "$delay"
+          else
+            echo "::error::retry: command failed after $attempts attempts (rc=$rc)"
+          fi
+        done
+        exit 1

.github/actions/setup-build-environment/action.yml

@@ -21,15 +21,26 @@ runs:
 
         mkdir -p "${{ github.workspace }}/kernel"
         mkdir -p "${{ github.workspace }}/git-repo"
-        curl -L https://storage.googleapis.com/git-repo-downloads/repo -o "${{ github.workspace }}/git-repo/repo"
+        # Retry transient network errors (up to 5 attempts, 5s backoff).
+        retry() {
+          local n=0
+          until [ "$n" -ge 5 ]; do
+            "$@" && return 0
+            n=$((n+1))
+            echo "retry $n/5 failed for: $*"
+            sleep 5
+          done
+          return 1
+        }
+        retry curl -L https://storage.googleapis.com/git-repo-downloads/repo -o "${{ github.workspace }}/git-repo/repo"
         chmod +x "${{ github.workspace }}/git-repo/repo"
         echo "${{ github.workspace }}/git-repo" >> "$GITHUB_PATH"
 
         if [ -d "${{ github.workspace }}/kernel_patches" ]; then rm -rf "${{ github.workspace }}/kernel_patches"; fi
-        git clone https://github.com/WildKernels/kernel_patches.git "${{ github.workspace }}/kernel_patches"
+        retry git clone https://github.com/WildKernels/kernel_patches.git "${{ github.workspace }}/kernel_patches"
 
         if [ -d "${{ github.workspace }}/AnyKernel3" ]; then rm -rf "${{ github.workspace }}/AnyKernel3"; fi
-        git clone https://github.com/WildKernels/AnyKernel3.git -b gki-2.0 "${{ github.workspace }}/AnyKernel3"
+        retry git clone https://github.com/WildKernels/AnyKernel3.git -b gki-2.0 "${{ github.workspace }}/AnyKernel3"
 
     - name: Install build deps for BTF generation (android12-5.10)
       shell: bash

.github/actions/susfs-setup/action.yml

@@ -17,17 +17,29 @@ runs:
       run: |
         set -euo pipefail
 
+        # Retry transient network errors (up to 5 attempts, 5s backoff).
+        retry() {
+          local n=0
+          until [ "$n" -ge 5 ]; do
+            "$@" && return 0
+            n=$((n+1))
+            echo "retry $n/5 failed for: $*" >&2
+            sleep 5
+          done
+          return 1
+        }
+
         SUSFS_BRANCH="gki-${{ inputs.version }}"
         SUSFS_REPO="https://gitlab.com/simonpunk/susfs4ksu.git"
 
         echo "Preparing SUSFS for branch: $SUSFS_BRANCH"
         echo "Cloning latest from $SUSFS_BRANCH..."
-        git clone "$SUSFS_REPO" -b "$SUSFS_BRANCH" susfs4ksu
+        retry git clone "$SUSFS_REPO" -b "$SUSFS_BRANCH" susfs4ksu
 
         if [ -n "${{ inputs.susfs_commit }}" ]; then
           echo "Checking out SUSFS commit: ${{ inputs.susfs_commit }}"
           cd ${{ github.workspace }}/susfs4ksu
-          git checkout "${{ inputs.susfs_commit }}"
+          retry git checkout "${{ inputs.susfs_commit }}"
         fi
 
         cd susfs4ksu

.github/workflows/commit-status.yml

@@ -30,20 +30,20 @@ jobs:
 
           gitlab_latest_commit() {
             local branch="$1"
-            curl -fsSL "https://gitlab.com/api/v4/projects/simonpunk%2Fsusfs4ksu/repository/commits?ref_name=${branch}&per_page=1" | jq -r '.[0].id'
+            curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://gitlab.com/api/v4/projects/simonpunk%2Fsusfs4ksu/repository/commits?ref_name=${branch}&per_page=1" | jq -r '.[0].id'
           }
 
           gitlab_latest_message() {
             local branch="$1"
-            curl -fsSL "https://gitlab.com/api/v4/projects/simonpunk%2Fsusfs4ksu/repository/commits?ref_name=${branch}&per_page=1" | jq -r '.[0].message | split("\n")[0]'
+            curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://gitlab.com/api/v4/projects/simonpunk%2Fsusfs4ksu/repository/commits?ref_name=${branch}&per_page=1" | jq -r '.[0].message | split("\n")[0]'
           }
 
           github_latest_commit() {
-            curl -fsSL "https://api.github.com/repos/pershoot/KernelSU-Next/commits/dev-susfs" | jq -r '.sha'
+            curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/pershoot/KernelSU-Next/commits/dev-susfs" | jq -r '.sha'
           }
 
           github_latest_message() {
-            curl -fsSL "https://api.github.com/repos/pershoot/KernelSU-Next/commits/dev-susfs" | jq -r '.commit.message | split("\n")[0]'
+            curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/pershoot/KernelSU-Next/commits/dev-susfs" | jq -r '.commit.message | split("\n")[0]'
           }
 
           {