Retry CI pip installs of uv past PyPI download blips

[Mikola Lysenko (mikolalysenko)]

Problem

PR #1234 was knocked out of its merge-queue group at 08:21 UTC today. Merge group run 37904060236 failed in hosted-e2e → Install uv:

ERROR: Could not install packages due to an OSError: ('Connection broken: IncompleteRead(8268 bytes read, 637766 more expected)', ...)

Because ci-ok failed, the group was cancelled, and every entry queued behind #1234 (#1222) now has to be rebuilt. The tests never ran, so the PR itself was fine.

Root cause

python -m pip install has no retry for this failure. pip's --retries only covers connection setup. A body that gets cut off partway through the download raises OSError right away. Six CI steps install uv this way with no retry: hosted-e2e, the e2e uv/PDM/Hatch/Poetry legs, and the PDM/Poetry compatibility workflows (three steps in each place).

Fix

I added scripts/pip-install-retry.sh. It runs python -m pip install --disable-pip-version-check "$@" up to 4 times, waiting 10, 20 and 30 s between attempts. This is the same pattern the vexctl go install loop in ci.yml already uses. Arguments are passed through unchanged, so pinned versions (uv==0.11.19, uv==$UV_TEST_VERSION) stay pinned. Each of the six steps now calls the script. The PDM/Hatch step gains shell: bash; its legs run on ubuntu and macOS only, so bash is always available.

No tests were moved or removed. Required check names and ci-ok are unchanged.

Proof

• I faked a python that fails before succeeding: it fails once and then passes (exit 0), and after 4 failures it gives up with ::error:: (exit 1). With no arguments it prints usage (exit 2).
• A real run, scripts/pip-install-retry.sh --upgrade pip uv==0.11.19 in a fresh venv, installs uv 0.11.19.
• All three workflows parse as YAML. actionlint and zizmor are not installed here, so the "Audit GHA Workflows" check covers them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JGxqGHPVZJ5GpeK7Znnd5u

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4dbef28. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review (burn-down agent).

• Head: 4dbef28
• CI: 324/324 green (311 success, 12 skipped, 1 neutral)
• Bugbot: reviewed 4dbef28, no findings
• Mergeable, no CHANGELOG.md changes.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Adds scripts/pip-install-retry.sh, which runs python -m pip install --disable-pip-version-check "$@" up to 4 times (sleeping 10/20/30 s) and then fails with an ::error::. The 7 uv-install steps in ci.yml (e2e, e2e-windows, e2e-macos, e2e-full, hosted-e2e), pdm-compatibility.yml and poetry-compatibility.yml now call it.

Risk: low. CI only. Failures still fail the step after a bounded number of attempts; arguments are quoted and passed through unchanged, so pins are preserved.

Look here:

• scripts/pip-install-retry.sh:13-31: the retry loop
• .github/workflows/ci.yml:1378-1386: call site with the new shell: bash
• .github/workflows/ci.yml:2483: hosted-e2e (script && uv --version)
• .github/workflows/pdm-compatibility.yml:132

Verified: every changed step runs after checkout on ubuntu/macOS (no Windows leg has uv/pdm/hatch/poetry keys, so bash is always available). set -euo pipefail is safe (call inside if, empty-args exits early, OK on macOS bash 3.2). With a fake python on PATH: succeeds after one failure, gives up with rc 1 after 4, and an argument with a space reaches pip as one argument. No other python -m pip install left in the workflows. CI 324/324 green on 4dbef28 (ci-ok, clippy). Bugbot: no findings on this head. No CHANGELOG.md change, no open threads.

Changes I made: none.

Open questions (non-blocking):

• The description says the PDM/Hatch step "only runs on ubuntu legs"; e2e-macos also has pdm/hatch legs (works fine, description only).
• pdm-/poetry-compatibility.yml paths: filters don't list scripts/pip-install-retry.sh, so later edits to the script won't trigger those workflows.

Auto-merge is armed: approving sends this straight to the merge queue.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Both open questions:

• Description: fixed. It now says the PDM/Hatch legs run on ubuntu and macOS.
• paths: filters: true, an edit to the script alone won't trigger pdm- or poetry-compatibility. ci.yml still runs it on every PR, though, and pushing a filter-only change now would restart all 324 checks for no behaviour change. I'm leaving it for the next PR that touches those workflows.

---

Generated by Claude Code