From f44b8c3bd0d6f86fdf44b6c4c638ba131423e61e Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 22:21:46 +0000
Subject: [PATCH 1/3] secret-scan: use curl exponential backoff, cap retry
 window at 2m

Fixed 5s retry delay x3 gave ~15s of retry coverage against GitHub's
transient release-asset 500s. Drop --retry-delay so curl uses its
default exponential backoff (1s, 2s, 4s, ...) and cap total retry time
at 120s with --retry-max-time, applied to the release probe and all
four TruffleHog asset downloads.

Co-Authored-By: Ming Chen <ming.chen@sentry.io>
---
 .github/workflows/secret-scan.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 88adecc..c523cae 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -27,7 +27,7 @@ jobs:
           for tag in $RELEASES; do
             version="${tag#v}"
             url="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/trufflesecurity/trufflehog/releases/download/${tag}/trufflehog_${version}_linux_amd64.tar.gz"
-            if curl --head --fail --silent --show-error --retry 2 --retry-delay 3 --retry-all-errors "$url" > /dev/null 2>&1; then
+            if curl --head --fail --silent --show-error --retry 8 --retry-max-time 120 --retry-all-errors "$url" > /dev/null 2>&1; then
               LATEST_TAG_NAME="$tag"
               break
             fi
@@ -44,10 +44,10 @@ jobs:
           echo "latest_release=${LATEST_TAG_NAME#v}" >> "$GITHUB_OUTPUT"
       - name: Download and verify TruffleHog release
         run: |
-          curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
-          curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
-          curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
-          curl -fsSL --retry 3 --retry-delay 5 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
 
           cosign verify-blob trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt \
             --certificate trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem \

From 94d6ee9dee780ad9d7cff3cd40258fea80c669a3 Mon Sep 17 00:00:00 2001
From: Ming Chen <ming.chen@sentry.io>
Date: Thu, 10 Sep 2026 15:35:45 -0700
Subject: [PATCH 2/3] secret-scan: pin cosign download, keep 404 probe fast,
 log failing hop

- Replace sigstore/cosign-installer with a pinned, checksummed curl using the same backoff, since the action's retries are hard-coded and one of this week's failures was its download 504ing.
- Drop --retry-all-errors from the release probe so a not-yet-published release (404) falls through to the next tag immediately instead of retrying for two minutes.
- Print effective URL and status on each download so the log shows which hop failed.
---
 .github/workflows/secret-scan.yml | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index c523cae..12eff8d 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -13,8 +13,14 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Cosign
-        # v4 of the action install v3 of the CLI. v4 of the CLI will deprecate some features so be aware.
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        # Pinned download instead of sigstore/cosign-installer: the action's curl retries are hard-coded and too short to ride out GitHub release-download blips.
+        env:
+          COSIGN_VERSION: v3.0.6
+          COSIGN_SHA256: c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74
+        run: |
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -o cosign "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/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64"
+          echo "${COSIGN_SHA256}  cosign" | sha256sum -c
+          install -m 0755 cosign /usr/local/bin/cosign
       - name: Pin Trufflehog to a known good release
         id: trufflehog_release
         shell: bash
@@ -27,7 +33,7 @@ jobs:
           for tag in $RELEASES; do
             version="${tag#v}"
             url="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/trufflesecurity/trufflehog/releases/download/${tag}/trufflehog_${version}_linux_amd64.tar.gz"
-            if curl --head --fail --silent --show-error --retry 8 --retry-max-time 120 --retry-all-errors "$url" > /dev/null 2>&1; then
+            if curl --head --fail --silent --show-error --retry 8 --retry-max-time 120 "$url" > /dev/null 2>&1; then
               LATEST_TAG_NAME="$tag"
               break
             fi
@@ -44,10 +50,10 @@ jobs:
           echo "latest_release=${LATEST_TAG_NAME#v}" >> "$GITHUB_OUTPUT"
       - name: Download and verify TruffleHog release
         run: |
-          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
-          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
-          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
-          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.sig
+          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -O https://github.com/trufflesecurity/trufflehog/releases/download/${{ steps.trufflehog_release.outputs.latest_tag_name }}/trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_linux_amd64.tar.gz
 
           cosign verify-blob trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt \
             --certificate trufflehog_${{ steps.trufflehog_release.outputs.latest_release }}_checksums.txt.pem \

From 7f1dfb984c1a31af26ec99134bc05a65a3252af5 Mon Sep 17 00:00:00 2001
From: Ming Chen <ming.chen@sentry.io>
Date: Thu, 10 Sep 2026 15:37:51 -0700
Subject: [PATCH 3/3] secret-scan: keep sigstore/cosign-installer as-is

Out of scope for the retry bump; noted the gap in the PR body instead.
---
 .github/workflows/secret-scan.yml | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 12eff8d..1300e88 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -13,14 +13,8 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Cosign
-        # Pinned download instead of sigstore/cosign-installer: the action's curl retries are hard-coded and too short to ride out GitHub release-download blips.
-        env:
-          COSIGN_VERSION: v3.0.6
-          COSIGN_SHA256: c956e5dfcac53d52bcf058360d579472f0c1d2d9b69f55209e256fe7783f4c74
-        run: |
-          curl -fsSL --retry 8 --retry-max-time 120 --retry-all-errors -w '%{url_effective} %{http_code}\n' -o cosign "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/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64"
-          echo "${COSIGN_SHA256}  cosign" | sha256sum -c
-          install -m 0755 cosign /usr/local/bin/cosign
+        # v4 of the action install v3 of the CLI. v4 of the CLI will deprecate some features so be aware.
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Pin Trufflehog to a known good release
         id: trufflehog_release
         shell: bash