From ae6e267bce6aee0b02c73de99382024f21751de8 Mon Sep 17 00:00:00 2001
From: "John M. Kuchta" <git@chir.us>
Date: Wed, 10 Jun 2026 11:01:50 -0700
Subject: [PATCH] ci: retry gh release list in watch-openapi (transient 401)

The check-* jobs each mint their own GITHUB_TOKEN and hit api.github.com
concurrently at job start. Occasionally one token 401s on first use
(check-beta in run 27286337590), failing the whole run while sibling
jobs pass with the same command. Wrap the lookup in a 5-attempt backoff
so a transient auth blip no longer fails the run.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/watch-openapi-release.yml | 39 +++++++++++++++++++--
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/watch-openapi-release.yml b/.github/workflows/watch-openapi-release.yml
index 0c388f3b..70ffd7d6 100644
--- a/.github/workflows/watch-openapi-release.yml
+++ b/.github/workflows/watch-openapi-release.yml
@@ -25,7 +25,18 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          LATEST=$(gh release list --repo meraki/openapi --exclude-pre-releases --limit 1 --json tagName -q '.[0].tagName')
+          # Retry: api.github.com occasionally 401s a job's freshly-minted token.
+          for attempt in 1 2 3 4 5; do
+            if LATEST=$(gh release list --repo meraki/openapi --exclude-pre-releases --limit 1 --json tagName -q '.[0].tagName'); then
+              break
+            fi
+            if [ "$attempt" = 5 ]; then
+              echo "::error::gh release list failed after 5 attempts"
+              exit 1
+            fi
+            echo "::warning::gh release list failed (attempt $attempt/5); retrying in $((attempt * 3))s"
+            sleep $((attempt * 3))
+          done
           API_VERSION="${LATEST#v}"
           # Reject anything that isn't a clean semver tag before it flows into
           # downstream run: steps / workflow_dispatch inputs (script injection guard).
@@ -68,7 +79,18 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          LATEST=$(gh release list --repo meraki/openapi --limit 20 --json tagName,isPrerelease -q '[.[] | select(.isPrerelease)] | .[0].tagName')
+          # Retry: api.github.com occasionally 401s a job's freshly-minted token.
+          for attempt in 1 2 3 4 5; do
+            if LATEST=$(gh release list --repo meraki/openapi --limit 20 --json tagName,isPrerelease -q '[.[] | select(.isPrerelease)] | .[0].tagName'); then
+              break
+            fi
+            if [ "$attempt" = 5 ]; then
+              echo "::error::gh release list failed after 5 attempts"
+              exit 1
+            fi
+            echo "::warning::gh release list failed (attempt $attempt/5); retrying in $((attempt * 3))s"
+            sleep $((attempt * 3))
+          done
           if [ -z "$LATEST" ]; then
             echo "has_new_release=false" >> "$GITHUB_OUTPUT"
             exit 0
@@ -132,7 +154,18 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          LATEST=$(gh release list --repo meraki/openapi --limit 20 --json tagName,isPrerelease -q '[.[] | select(.isPrerelease)] | .[0].tagName')
+          # Retry: api.github.com occasionally 401s a job's freshly-minted token.
+          for attempt in 1 2 3 4 5; do
+            if LATEST=$(gh release list --repo meraki/openapi --limit 20 --json tagName,isPrerelease -q '[.[] | select(.isPrerelease)] | .[0].tagName'); then
+              break
+            fi
+            if [ "$attempt" = 5 ]; then
+              echo "::error::gh release list failed after 5 attempts"
+              exit 1
+            fi
+            echo "::warning::gh release list failed (attempt $attempt/5); retrying in $((attempt * 3))s"
+            sleep $((attempt * 3))
+          done
           if [ -z "$LATEST" ]; then
             echo "has_new_release=false" >> "$GITHUB_OUTPUT"
             exit 0