From 177252b388e3c28d4c6a7b44fa1be5ca3d98ae52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:56:25 -0300
Subject: [PATCH 1/2] ci: harden leanSpec fixtures release-info step

The daily CI intermittently failed with `Invalid format '<!--'` when
writing to $GITHUB_OUTPUT. Root cause: the fixtures release-info step
fetched the release metadata and checksum with `curl -sL` (no `-f`), so a
transient HTML error page from the GitHub API/asset CDN was captured as
data and written verbatim into $GITHUB_OUTPUT, corrupting it. A command
substitution in an assignment does not trip `set -e`, so the bad value
propagated silently.

Harden the step:
- Authenticate the API call with github.token (unauthenticated requests
  share the runner IP's low rate-limit pool, the usual trigger).
- Add `-f` + `--retry`/`--retry-all-errors` so HTTP errors fail fast and
  transient hiccups are ridden out instead of captured as data.
- Fail loudly on each curl/parse (assignments don't propagate errexit).
- Validate the checksum is a 64-char hex string before writing output.
---
 .github/actions/run-fixture-tests/action.yml | 39 ++++++++++++++++++--
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/.github/actions/run-fixture-tests/action.yml b/.github/actions/run-fixture-tests/action.yml
index fe7a1db0..10abd36c 100644
--- a/.github/actions/run-fixture-tests/action.yml
+++ b/.github/actions/run-fixture-tests/action.yml
@@ -10,12 +10,43 @@ runs:
     - name: Get leanSpec fixtures release info
       id: fixtures-release
       shell: bash
+      env:
+        # Authenticate the API call: unauthenticated requests share the runner
+        # IP's low rate-limit pool, which is the usual cause of transient failures.
+        GH_TOKEN: ${{ github.token }}
       run: |
+        set -euo pipefail
         api_url="https://api.github.com/repos/leanEthereum/leanSpec/releases/latest"
-        json=$(curl -sL "$api_url")
-        fixtures_url=$(echo "$json" | python3 -c "import sys,json; j=json.load(sys.stdin); print(next(a.get('browser_download_url') for a in j.get('assets',[]) if a.get('name')=='fixtures-prod-scheme.tar.gz'))")
-        sha_url=$(echo "$json" | python3 -c "import sys,json; j=json.load(sys.stdin); print(next(a.get('browser_download_url') for a in j.get('assets',[]) if a.get('name')=='fixtures-prod-scheme.tar.gz.sha256'))")
-        sha=$(curl -sL "$sha_url" | cut -d' ' -f1)
+
+        # -f fails on HTTP errors (so an error body is never captured as data) and
+        # --retry rides out transient network/5xx hiccups. Fail loudly, since a
+        # command substitution in an assignment does not trip `set -e` on its own.
+        json=$(curl -sSL -f --retry 5 --retry-all-errors \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer $GH_TOKEN" \
+          "$api_url") \
+          || { echo "::error::Failed to fetch leanSpec latest release metadata from $api_url"; exit 1; }
+
+        asset_url() {
+          echo "$json" | python3 -c \
+            "import sys,json; name=sys.argv[1]; j=json.load(sys.stdin); print(next(a['browser_download_url'] for a in j.get('assets',[]) if a.get('name')==name))" \
+            "$1"
+        }
+        fixtures_url=$(asset_url "fixtures-prod-scheme.tar.gz") \
+          || { echo "::error::Release is missing the fixtures-prod-scheme.tar.gz asset"; exit 1; }
+        sha_url=$(asset_url "fixtures-prod-scheme.tar.gz.sha256") \
+          || { echo "::error::Release is missing the fixtures-prod-scheme.tar.gz.sha256 asset"; exit 1; }
+
+        sha=$(curl -sSL -f --retry 5 --retry-all-errors "$sha_url" | cut -d' ' -f1) \
+          || { echo "::error::Failed to download the fixtures checksum from $sha_url"; exit 1; }
+
+        # Validate before writing: a transient HTML error page captured as $sha
+        # previously corrupted $GITHUB_OUTPUT ("Invalid format '<!--'").
+        if [[ ! "$sha" =~ ^[0-9a-fA-F]{64}$ ]]; then
+          echo "::error::Expected a 64-char hex SHA256 for the fixtures archive, got: '$sha'"
+          exit 1
+        fi
+
         {
           echo "url=$fixtures_url"
           echo "sha_url=$sha_url"

From 9ca4a125ee87d3aef60497d74cd5bfa540c29da5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 8 Jul 2026 11:23:48 -0300
Subject: [PATCH 2/2] ci: retry fixtures download on transient errors

Apply the same --retry/--retry-all-errors hardening to the fixtures and
checksum downloads, so a transient blip in the download step can't flake
CI either. Still -f-guarded and sha256-verified.
---
 .github/actions/run-fixture-tests/action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/run-fixture-tests/action.yml b/.github/actions/run-fixture-tests/action.yml
index 10abd36c..61de7e6e 100644
--- a/.github/actions/run-fixture-tests/action.yml
+++ b/.github/actions/run-fixture-tests/action.yml
@@ -70,8 +70,8 @@ runs:
         fixtures_url="${{ steps.fixtures-release.outputs.url }}"
         sha_url="${{ steps.fixtures-release.outputs.sha_url }}"
         echo "Downloading fixtures from $fixtures_url"
-        curl -L -f -o "$tmpdir/fixtures-prod-scheme.tar.gz" "$fixtures_url"
-        curl -L -f -o "$tmpdir/fixtures-prod-scheme.tar.gz.sha256" "$sha_url"
+        curl -L -f --retry 5 --retry-all-errors -o "$tmpdir/fixtures-prod-scheme.tar.gz" "$fixtures_url"
+        curl -L -f --retry 5 --retry-all-errors -o "$tmpdir/fixtures-prod-scheme.tar.gz.sha256" "$sha_url"
         expected=$(cut -d' ' -f1 "$tmpdir/fixtures-prod-scheme.tar.gz.sha256")
         actual=$(sha256sum "$tmpdir/fixtures-prod-scheme.tar.gz" | awk '{print $1}')
         if [ "$expected" != "$actual" ]; then