From 56ffafc68784d228b301167c8383c3427593541e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adam=20=C5=9Awiderski?= <adam.swiderski@hyland.com>
Date: Wed, 5 Aug 2026 08:25:43 +0200
Subject: [PATCH] [ACS-12418] fix(ci): add retry loops for docker login, helm
 dep build, and playwright install (#5326)

---
 .github/actions/deploy-local-acs/action.yml   | 58 ++++++++++++++++++-
 .github/workflows/e2e-playwright-reusable.yml | 27 +++++++--
 2 files changed, 80 insertions(+), 5 deletions(-)

diff --git a/.github/actions/deploy-local-acs/action.yml b/.github/actions/deploy-local-acs/action.yml
index 59aa3254a..3eb14091b 100644
--- a/.github/actions/deploy-local-acs/action.yml
+++ b/.github/actions/deploy-local-acs/action.yml
@@ -33,18 +33,63 @@ runs:
         version: "3.14.3"
 
     - name: Login to Docker Hub
+      id: dockerhub-login
       uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+      continue-on-error: true
       with:
         username: ${{ inputs.docker_username }}
         password: ${{ inputs.docker_password }}
 
+    - name: Retry Docker Hub login on transient failure
+      if: steps.dockerhub-login.outcome == 'failure'
+      shell: bash
+      env:
+        DOCKER_USERNAME: ${{ inputs.docker_username }}
+        DOCKER_PASSWORD: ${{ inputs.docker_password }}
+      run: |
+        for attempt in 1 2 3; do
+          err=$(echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin 2>&1) && exit 0
+          # Bail out on credential errors; retrying only annoys the registry and delays the real fix.
+          if echo "$err" | grep -qiE "401|403|unauthorized|denied|forbidden"; then
+            echo "$err"
+            exit 1
+          fi
+          sleep_s=$((attempt * 5))
+          echo "docker login attempt $attempt failed: $err"
+          echo "retrying in ${sleep_s}s..."
+          sleep "$sleep_s"
+        done
+        exit 1
+
     - name: Login to Quay.io
+      id: quay-login
       uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
+      continue-on-error: true
       with:
         registry: quay.io
         username: ${{ inputs.quay_username }}
         password: ${{ inputs.quay_password }}
 
+    - name: Retry Quay.io login on transient failure
+      if: steps.quay-login.outcome == 'failure'
+      shell: bash
+      env:
+        QUAY_USERNAME: ${{ inputs.quay_username }}
+        QUAY_PASSWORD: ${{ inputs.quay_password }}
+      run: |
+        for attempt in 1 2 3; do
+          err=$(echo "$QUAY_PASSWORD" | docker login quay.io -u "$QUAY_USERNAME" --password-stdin 2>&1) && exit 0
+          if echo "$err" | grep -qiE "401|403|unauthorized|denied|forbidden"; then
+            echo "$err"
+            exit 1
+          fi
+          sleep_s=$((attempt * 5))
+          echo "quay login attempt $attempt failed: $err"
+          echo "retrying in ${sleep_s}s..."
+          sleep "$sleep_s"
+        done
+        exit 1
+
     - name: Setup cluster
       uses: Alfresco/alfresco-build-tools/.github/actions/setup-kind@v18.21.0
       with:
@@ -127,7 +172,18 @@ runs:
         ACS_VERSION_INPUT: ${{ inputs.acs_deployment_version }}
       run: |
         [ "$ACS_VERSION_INPUT" = "master" ] && chart_values="pre-release_values.yaml" || chart_values="values.yaml"
-        helm dep build acs-deployment/helm/alfresco-content-services
+        for attempt in 1 2 3; do
+          if helm dep build acs-deployment/helm/alfresco-content-services; then
+            break
+          fi
+          if [ "$attempt" -eq 3 ]; then
+            echo "helm dep build failed after 3 attempts"
+            exit 1
+          fi
+          sleep_s=$((attempt * 10))
+          echo "helm dep build attempt $attempt failed, retrying in ${sleep_s}s..."
+          sleep "$sleep_s"
+        done
         helm install acs acs-deployment/helm/alfresco-content-services \
           --set global.search.sharedSecret="$(openssl rand -hex 24)" \
           --values "acs-deployment/helm/alfresco-content-services/${chart_values}" \
diff --git a/.github/workflows/e2e-playwright-reusable.yml b/.github/workflows/e2e-playwright-reusable.yml
index d3a8b38fc..8e3b4bbd0 100644
--- a/.github/workflows/e2e-playwright-reusable.yml
+++ b/.github/workflows/e2e-playwright-reusable.yml
@@ -164,11 +164,30 @@ jobs:
         env:
           ADMIN_PASSWORD_SCRIPT: ${{ env.ADMIN_PASSWORD }}
 
-      - name: Before playwright
-        run: npm run ci:playwright:install:all
+      # global.setup.ts always launches chromium, so it is installed alongside the matrix browser.
+      - name: Install Playwright browsers + system deps
+        env:
+          PLAYWRIGHT_BROWSER: ${{ matrix.browser }}
+        run: |
+          # Drop the pre-installed azure-cli apt source; it intermittently 403s and breaks `apt-get update`.
+          { grep -rl "packages.microsoft.com/repos/azure-cli" /etc/apt/sources.list.d/ 2>/dev/null || true; } | while IFS= read -r f; do
+            echo "Removing flaky apt source: $f"
+            sudo rm -f "$f"
+          done
 
-      - name: Install Playwright system dependencies
-        run: npx playwright install-deps
+          browsers=$(echo "chromium ${PLAYWRIGHT_BROWSER}" | tr ' ' '\n' | awk '!seen[$0]++' | tr '\n' ' ')
+          echo "Installing Playwright browsers: $browsers"
+
+          for attempt in 1 2 3; do
+            if npx playwright install --with-deps $browsers; then
+              exit 0
+            fi
+            sleep_s=$((attempt * 10))
+            echo "playwright install attempt $attempt failed, retrying in ${sleep_s}s..."
+            sleep "$sleep_s"
+          done
+          echo "playwright install failed after 3 attempts"
+          exit 1
 
       - name: Run e2e playwright
         uses: ./.github/actions/run-e2e-playwright