artifact: honor Retry-After on HTTP 429 and prepare 6.3.0

[tunc-d]

Replaces closed #2498, reapplied onto current actions/toolkit:main without the superseded dependency/release history.

• Honor trimmed, positive integer Retry-After seconds only on HTTP 429, reading the header before body parsing. Missing, zero, negative, fractional, HTTP-date, or malformed values fall back to exponential backoff.
• Raise the initial fallback wait from 3 to 8 seconds; retain the 1.5 multiplier and five total attempts. Limit accumulated retry sleep to 120 seconds (not a wall-clock request timeout), allow exactly 120 seconds, and never sleep after the final failure.
• Prepare @actions/artifact 6.3.0 with its manifest, npm-generated lockfile, and release notes. The dependency graph is unchanged; no audit fixes or other package releases are included.

Local validation: all 166 artifact tests, all package builds, targeted lint/format, packed entry points/declarations/version helper, root production audit, and all nine packages covered by the CI audit script passed. An additional audit of unchanged attest dependencies found existing advisories; attest has no audit-moderate script and is not part of that CI audit job.

Release preparation only: per docs/release.md and the Publish NPM workflow, a maintainer must publish after merge with package=artifact, branch=main, npm-tag=latest (test-all optional). No publishing, manual release workflow, merge, or auto-merge has been triggered.

[Copilot]

Copilot review overview

🟢 Approval recommended

No blocking issues were identified, and all 21 current-head checks passed, including the build that failed on the superseded PR.

Review effort: Balanced
Findings: None

What changed in this PR

Improves @actions/artifact retry handling for rate-limited requests and prepares version 6.3.0 without dependency changes.

Changes:

• Honors positive integer Retry-After values on HTTP 429.
• Raises initial fallback waits to 8 seconds and caps accumulated retry sleep at 120 seconds, with boundary tests.
• Updates release notes and package version metadata.

File	Description
packages/​artifact/​src/​internal/​shared/​artifact-twirp-client.ts	Adds header-aware retries and accumulated-sleep limits.
packages/​artifact/​RELEASES.md	Documents 6.3.0 retry changes.
packages/​artifact/​package.json	Sets version to 6.3.0.
packages/​artifact/​package-lock.json	Synchronizes package version metadata.
packages/​artifact/​__tests__/​artifact-http-client.test.ts	Tests header parsing, fallback waits, and retry limits.

Files not reviewed (1)

• packages/artifact/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.