ci: preserve verified artifacts and recover network operations

.github/scripts/ci_network.sh

@@ -0,0 +1,116 @@
+# shellcheck shell=bash
+# CI network operations have bounded retries; build and test commands are not retried.
+ci_retry() {
+  local attempt status stdout_file stderr_file
+  stdout_file=$(mktemp)
+  stderr_file=$(mktemp)
+  for attempt in 1 2 3; do
+    if "$@" >"$stdout_file" 2>"$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return 0
+    else
+      status=$?
+    fi
+    if [[ "$attempt" == 3 ]] || ! grep -Eiq 'HTTP[^0-9]*(408|429|500|502|503|504)|timed? out|timeout|connection (reset|refused|closed)|temporary failure|TLS handshake|unexpected EOF|could not resolve host|failed to connect|remote end hung up' "$stdout_file" "$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return "$status"
+    fi
+    sleep "$((attempt * 2))"
+  done
+}
+gh() { ci_retry command gh "$@"; }
+git() {
+  if [[ "${1:-}" != clone ]]; then
+    command git "$@"
+    return
+  fi
+  local destination temporary status
+  local clone_args=("$@")
+  destination="${clone_args[${#clone_args[@]}-1]}"
+  # Calls without an explicit destination keep git's native behavior.
+  if [[ "$destination" == *://* || "$destination" == *.git ]]; then
+    ci_retry command git "$@"
+    return
+  fi
+  if [[ -e "$destination" || -L "$destination" ]]; then
+    printf 'Clone destination already exists.\n' >&2
+    return 1
+  fi
+  mkdir -p "$(dirname "$destination")"
+  temporary=$(mktemp -d "${destination}.ci-XXXXXX")
+  clone_args[${#clone_args[@]}-1]="$temporary"
+  # A failed clone may leave a partial checkout; clear only our owned temp directory.
+  if ci_retry ci_clone_attempt "$temporary" "${clone_args[@]}"; then
+    if [[ -e "$destination" || -L "$destination" ]]; then
+      rm -rf "$temporary"
+      return 1
+    fi
+    mv "$temporary" "$destination"
+  else
+    status=$?
+    rm -rf "$temporary"
+    return "$status"
+  fi
+}
+ci_clone_attempt() {
+  local temporary="$1"
+  shift
+  rm -rf "$temporary"
+  command git "$@"
+}
+curl() {
+  local argument mutating=false status stdout_file stderr_file source_index=-1 backup='' i
+  local curl_args=("$@")
+  for ((i=0; i<${#curl_args[@]}; i++)); do
+    argument="${curl_args[i]}"
+    case "$argument" in
+      --data*|-d*|--form*|-F*|--upload-file*|-T*) mutating=true ;;
+      POST|PATCH|PUT|DELETE|-XPOST|-XPATCH|-XPUT|-XDELETE|--request=POST|--request=PATCH|--request=PUT|--request=DELETE) mutating=true ;;
+      https://*) source_index=$i ;;
+    esac
+  done
+  if $mutating; then
+    # A timed-out mutation may already have reached the server.
+    command curl --fail-with-body --connect-timeout 15 --max-time 600 "${curl_args[@]}"
+    return
+  fi
+  if [[ "$source_index" -ge 0 ]]; then
+    case "${curl_args[source_index]}" in
+      https://cdn.spiritlhl.net/https://*|https://cdn.spiritlhl.top/https://*)
+        backup="${curl_args[source_index]#*/https://}"
+        backup="https://$backup" ;;
+      https://ftp.gnu.org/gnu/*)
+        backup="https://ftpmirror.gnu.org/${curl_args[source_index]#https://ftp.gnu.org/gnu/}" ;;
+    esac
+  fi
+  stdout_file=$(mktemp)
+  stderr_file=$(mktemp)
+  if command curl --fail-with-body --connect-timeout 15 --max-time 1200 --retry 3 --retry-max-time 180 --retry-connrefused "${curl_args[@]}" >"$stdout_file" 2>"$stderr_file"; then
+    cat "$stdout_file"
+    cat "$stderr_file" >&2
+    rm -f "$stdout_file" "$stderr_file"
+    return 0
+  else
+    status=$?
+  fi
+  if [[ -n "$backup" ]]; then
+    curl_args[source_index]="$backup"
+    if command curl --fail-with-body --connect-timeout 15 --max-time 1200 --retry 3 --retry-max-time 180 --retry-connrefused "${curl_args[@]}" >"$stdout_file" 2>"$stderr_file"; then
+      cat "$stdout_file"
+      cat "$stderr_file" >&2
+      rm -f "$stdout_file" "$stderr_file"
+      return 0
+    else
+      status=$?
+    fi
+  fi
+  cat "$stdout_file"
+  cat "$stderr_file" >&2
+  rm -f "$stdout_file" "$stderr_file"
+  return "$status"
+}
+wget() { command wget --tries=3 --timeout=45 --waitretry=2 --retry-connrefused "$@"; }

.github/workflows/action-policy.yml

@@ -26,3 +26,5 @@ jobs:
     - name: Verify private output isolation
       run: |
         if [[ -d .github/tests ]]; then python3 -m unittest discover -s .github/tests -p "test_*.py"; fi
+    env:
+      GOPROXY: https://proxy.golang.org|direct

.github/workflows/build.yml

@@ -1,17 +1,9 @@
 name: 创建IPv6检测的前缀
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *'
-
 concurrency:
   group: backtrace-ipv6-prefix-sync
   cancel-in-progress: false
-
 permissions:
   contents: write
-
 jobs:
   fetch-ipv6-prefixes:
     runs-on: ubuntu-latest
@@ -20,16 +12,13 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
-
     - name: 设置 Go
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: go.mod
-
     - name: 获取并处理多个ASN的IPv6前缀
       run: |
         go run ./cmd/update-prefixes -output-dir bk/prefix
-
     - name: 提交更新到仓库
       run: |
         git config user.name "github-actions[bot]"
@@ -41,3 +30,9 @@ jobs:
           git commit -m "chore: 更新多个 ASN 的 IPv6 前缀"
           git push
         fi
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  workflow_dispatch: null
+  schedule:
+  - cron: 0 0 * * *

.github/workflows/ci.yaml

@@ -1,19 +1,9 @@
 name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
 permissions:
   contents: read
-
 concurrency:
   group: backtrace-ci-${{ github.ref }}
   cancel-in-progress: true
-
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -32,3 +22,13 @@ jobs:
         go vet ./...
         go build -o "$RUNNER_TEMP/backtrace" ./cmd
         git diff --check
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  push:
+    branches:
+    - main
+  pull_request:
+    branches:
+    - main
+  workflow_dispatch: null

.github/workflows/main.yaml

@@ -1,18 +1,6 @@
 name: Build and Release
-
-on:
-  push:
-    tags: ["v*"]
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: Existing semantic version tag to build and release
-        required: true
-        type: string
-
 permissions:
   contents: write
-
 jobs:
   verify:
     runs-on: ubuntu-latest
@@ -52,54 +40,94 @@ jobs:
         go test -race -count=1 ./...
         go vet ./...
         go build -o "$RUNNER_TEMP/backtrace" ./cmd
-
+    env:
+      GOPROXY: https://proxy.golang.org|direct
   release:
     needs: verify
     runs-on: ubuntu-latest
     steps:
+    - name: Load trusted network recovery helpers
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl --fail --silent --show-error --location --connect-timeout 15 --max-time 90 --retry 3 --retry-max-time 180 --retry-connrefused "https://raw.githubusercontent.com/oneclickvirt/backtrace/main/.github/scripts/ci_network.sh" -o "$RUNNER_TEMP/ci-network.sh"
     - name: Create GitHub release
       env:
         GH_TOKEN: ${{ github.token }}
         RELEASE_TAG: ${{ needs.verify.outputs.tag }}
       shell: bash
       run: |
+        source "$RUNNER_TEMP/ci-network.sh"
         set -euo pipefail
         gh release view "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null 2>&1 || \
           gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
             --title "$RELEASE_TAG" --generate-notes
-
   build:
-    needs: [verify, release]
+    needs:
+    - verify
+    - release
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         include:
-          - {goos: linux, goarch: amd64}
+        - goos: linux
-          - {goos: linux, goarch: "386"}
+          goarch: amd64
-          - {goos: linux, goarch: arm, goarm: "7"}
+        - goos: linux
-          - {goos: linux, goarch: arm64}
+          goarch: '386'
-          - {goos: linux, goarch: riscv64}
+        - goos: linux
-          - {goos: linux, goarch: mips}
+          goarch: arm
-          - {goos: linux, goarch: mipsle}
+          goarm: '7'
-          - {goos: linux, goarch: mips64}
+        - goos: linux
-          - {goos: linux, goarch: mips64le}
+          goarch: arm64
-          - {goos: linux, goarch: ppc64}
+        - goos: linux
-          - {goos: linux, goarch: ppc64le}
+          goarch: riscv64
-          - {goos: freebsd, goarch: amd64}
+        - goos: linux
-          - {goos: freebsd, goarch: "386"}
+          goarch: mips
-          - {goos: freebsd, goarch: arm, goarm: "7"}
+        - goos: linux
-          - {goos: freebsd, goarch: arm64}
+          goarch: mipsle
-          - {goos: openbsd, goarch: amd64}
+        - goos: linux
-          - {goos: openbsd, goarch: "386"}
+          goarch: mips64
-          - {goos: openbsd, goarch: arm, goarm: "7"}
+        - goos: linux
-          - {goos: openbsd, goarch: arm64}
+          goarch: mips64le
-          - {goos: darwin, goarch: amd64}
+        - goos: linux
-          - {goos: darwin, goarch: arm64}
+          goarch: ppc64
-          - {goos: windows, goarch: "386"}
+        - goos: linux
-          - {goos: windows, goarch: amd64}
+          goarch: ppc64le
-          - {goos: windows, goarch: arm64}
+        - goos: freebsd
+          goarch: amd64
+        - goos: freebsd
+          goarch: '386'
+        - goos: freebsd
+          goarch: arm
+          goarm: '7'
+        - goos: freebsd
+          goarch: arm64
+        - goos: openbsd
+          goarch: amd64
+        - goos: openbsd
+          goarch: '386'
+        - goos: openbsd
+          goarch: arm
+          goarm: '7'
+        - goos: openbsd
+          goarch: arm64
+        - goos: darwin
+          goarch: amd64
+        - goos: darwin
+          goarch: arm64
+        - goos: windows
+          goarch: '386'
+        - goos: windows
+          goarch: amd64
+        - goos: windows
+          goarch: arm64
     steps:
+    - name: Load trusted network recovery helpers
+      shell: bash
+      run: |
+        set -euo pipefail
+        curl --fail --silent --show-error --location --connect-timeout 15 --max-time 90 --retry 3 --retry-max-time 180 --retry-connrefused "https://raw.githubusercontent.com/oneclickvirt/backtrace/main/.github/scripts/ci_network.sh" -o "$RUNNER_TEMP/ci-network.sh"
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
@@ -112,7 +140,7 @@ jobs:
         GOOS: ${{ matrix.goos }}
         GOARCH: ${{ matrix.goarch }}
         GOARM: ${{ matrix.goarm }}
-          CGO_ENABLED: "0"
+        CGO_ENABLED: '0'
       shell: bash
       run: |
         set -euo pipefail
@@ -125,4 +153,19 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
         RELEASE_TAG: ${{ needs.verify.outputs.tag }}
-        run: gh release upload "$RELEASE_TAG" "$ARTIFACT" --repo "$GITHUB_REPOSITORY" --clobber
+      run: |-
+        source "$RUNNER_TEMP/ci-network.sh"
+        gh release upload "$RELEASE_TAG" "$ARTIFACT" --repo "$GITHUB_REPOSITORY" --clobber
+      shell: bash
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  push:
+    tags:
+    - v*
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Existing semantic version tag to build and release
+        required: true
+        type: string

.github/workflows/release.yaml

@@ -1,20 +1,9 @@
 name: Prepare and Tag Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      release_tag:
-        description: Semantic version tag; leave empty to use BackTraceVersion
-        required: false
-        type: string
-
 permissions:
   contents: write
-
 concurrency:
   group: backtrace-release-data
   cancel-in-progress: false
-
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -76,3 +65,12 @@ jobs:
         set -euo pipefail
         git tag -a "$RELEASE_TAG" -m "Release $RELEASE_TAG"
         git push origin "refs/tags/$RELEASE_TAG"
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: Semantic version tag; leave empty to use BackTraceVersion
+        required: false
+        type: string

.github/workflows/sync-asn-metadata.yml

@@ -1,29 +1,9 @@
 name: Sync ASN metadata
-
-on:
-  schedule:
-    - cron: "29 3 * * *"
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - ".github/workflows/sync-asn-metadata.yml"
-      - "cmd/update-asn-metadata/**"
-      - "bgptools/data/**"
-      - "bgptools/asn_metadata.go"
-      - "bgptools/asn_metadata_test.go"
-      - "model/model.go"
-      - "go.mod"
-      - "go.sum"
-
 concurrency:
   group: backtrace-asn-metadata-sync
   cancel-in-progress: false
-
 permissions:
   contents: write
-
 jobs:
   sync:
     runs-on: ubuntu-latest
@@ -49,3 +29,21 @@ jobs:
         git add bgptools/data/bgp-asn-map.json bgptools/data/bgp-asn-map.manifest.json
         git commit -m "chore(data): update ASN metadata"
         git push
+    env:
+      GOPROXY: https://proxy.golang.org|direct
+'on':
+  schedule:
+  - cron: 29 3 * * *
+  workflow_dispatch: null
+  push:
+    branches:
+    - main
+    paths:
+    - .github/workflows/sync-asn-metadata.yml
+    - cmd/update-asn-metadata/**
+    - bgptools/data/**
+    - bgptools/asn_metadata.go
+    - bgptools/asn_metadata_test.go
+    - model/model.go
+    - go.mod
+    - go.sum