From acb446c30f7445af3065d5856ef08ad7a799ee4c Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Thu, 9 Jul 2026 01:42:27 -0400
Subject: [PATCH] Retry frontend-base registry login and harden Renovate
 endpoint auth

---
 .gitea/workflows/cicd.yaml    | 26 ++++++++++++-
 .gitea/workflows/renovate.yml | 73 ++++++++++++++++++++++++-----------
 2 files changed, 75 insertions(+), 24 deletions(-)

diff --git a/.gitea/workflows/cicd.yaml b/.gitea/workflows/cicd.yaml
index 995e587..6dcba80 100644
--- a/.gitea/workflows/cicd.yaml
+++ b/.gitea/workflows/cicd.yaml
@@ -882,6 +882,30 @@ jobs:
         run: |
           set -euo pipefail
 
+          retry_cmd() {
+            attempts="${1:-5}"
+            backoff="${2:-2}"
+            shift 2
+
+            attempt=1
+            while [ "${attempt}" -le "${attempts}" ]; do
+              if "$@"; then
+                return 0
+              fi
+
+              if [ "${attempt}" -lt "${attempts}" ]; then
+                sleep_seconds=$((backoff * attempt))
+                echo "Command failed (attempt ${attempt}/${attempts}): $*"
+                echo "Retrying in ${sleep_seconds}s"
+                sleep "${sleep_seconds}"
+              fi
+              attempt=$((attempt + 1))
+            done
+
+            echo "Command failed after ${attempts} attempts: $*"
+            return 1
+          }
+
           retry_registry_op() {
             op_name="$1"
             image_ref="$2"
@@ -912,7 +936,7 @@ jobs:
             return 1
           }
 
-          echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
+          retry_cmd 5 3 sh -c 'echo "${PACKAGE_ACCESS_TOKEN}" | docker login "http://${GITEA_REGISTRY}" -u "${REGISTRY_USER}" --password-stdin'
           FRONTEND_BASE_REPO="${GITEA_REGISTRY}/darkhelm.org/plex-playlist-frontend-base"
           FRONTEND_BASE_TAG_REF="${FRONTEND_BASE_REPO}:${HEAD_SHA}"
 
diff --git a/.gitea/workflows/renovate.yml b/.gitea/workflows/renovate.yml
index 66128eb..4f96b9e 100644
--- a/.gitea/workflows/renovate.yml
+++ b/.gitea/workflows/renovate.yml
@@ -88,14 +88,27 @@ jobs:
           RENOVATE_ENDPOINT_EFFECTIVE="${RENOVATE_ENDPOINT%/}"
           if [[ "${RENOVATE_ENDPOINT_EFFECTIVE}" == */api/v1 ]]; then
             API_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}"
+            BASE_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE%/api/v1}"
           else
             API_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}/api/v1"
+            BASE_ENDPOINT="${RENOVATE_ENDPOINT_EFFECTIVE}"
           fi
 
-          export RENOVATE_ENDPOINT="${API_ENDPOINT}"
-          echo "Renovate endpoint: ${RENOVATE_ENDPOINT}"
+          export RENOVATE_ENDPOINT="${BASE_ENDPOINT}"
+          echo "Renovate endpoint (primary): ${RENOVATE_ENDPOINT}"
+          echo "Renovate endpoint (fallback): ${API_ENDPOINT}"
           echo "Preflight API endpoint: ${API_ENDPOINT}"
 
+          ENDPOINT_HOST="$(printf '%s' "${RENOVATE_ENDPOINT_EFFECTIVE}" | sed -E 's#^https?://([^/]+).*$#\1#')"
+          ENDPOINT_IP="$(getent hosts "${ENDPOINT_HOST}" | awk '{print $1; exit}' || true)"
+          DOCKER_ADD_HOST_ARG=""
+          if [ -n "${ENDPOINT_IP}" ]; then
+            DOCKER_ADD_HOST_ARG="--add-host ${ENDPOINT_HOST}:${ENDPOINT_IP}"
+            echo "Renovate container host mapping: ${ENDPOINT_HOST} -> ${ENDPOINT_IP}"
+          else
+            echo "⚠ Unable to resolve ${ENDPOINT_HOST} on runner; proceeding without explicit --add-host"
+          fi
+
           CURL_INSECURE_FLAG=""
           if [ "${RENOVATE_ALLOW_INSECURE_TLS:-false}" = "true" ]; then
             echo "⚠ Renovate insecure TLS mode enabled for self-signed certificate endpoint"
@@ -170,27 +183,41 @@ jobs:
             unset RENOVATE_DRY_RUN
           fi
 
-          docker run --rm \
-            -e LOG_LEVEL \
-            -e NODE_TLS_REJECT_UNAUTHORIZED \
-            -e RENOVATE_TOKEN \
-            -e RENOVATE_PLATFORM \
-            -e RENOVATE_ENDPOINT \
-            -e RENOVATE_DRY_RUN \
-            -e RENOVATE_GIT_AUTHOR \
-            -e RENOVATE_ONBOARDING \
-            -e RENOVATE_REQUIRE_CONFIG \
-            -e RENOVATE_PR_CONCURRENT_LIMIT \
-            -e RENOVATE_BRANCH_CONCURRENT_LIMIT \
-            "${RENOVATE_IMAGE}" \
-            --platform "${RENOVATE_PLATFORM}" \
-            --endpoint "${RENOVATE_ENDPOINT}" \
-            --git-author "${RENOVATE_GIT_AUTHOR}" \
-            --onboarding="${RENOVATE_ONBOARDING}" \
-            --require-config "${RENOVATE_REQUIRE_CONFIG}" \
-            --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" \
-            --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" \
-            DarkHelm.org/plex-playlist | tee /tmp/renovate.log
+          run_renovate_with_endpoint() {
+            endpoint="$1"
+            export RENOVATE_ENDPOINT="${endpoint}"
+            echo "Running Renovate with endpoint: ${RENOVATE_ENDPOINT}"
+
+            # shellcheck disable=SC2086
+            docker run --rm ${DOCKER_ADD_HOST_ARG} \
+              -e LOG_LEVEL \
+              -e NODE_TLS_REJECT_UNAUTHORIZED \
+              -e RENOVATE_TOKEN \
+              -e RENOVATE_PLATFORM \
+              -e RENOVATE_ENDPOINT \
+              -e RENOVATE_DRY_RUN \
+              -e RENOVATE_GIT_AUTHOR \
+              -e RENOVATE_ONBOARDING \
+              -e RENOVATE_REQUIRE_CONFIG \
+              -e RENOVATE_PR_CONCURRENT_LIMIT \
+              -e RENOVATE_BRANCH_CONCURRENT_LIMIT \
+              "${RENOVATE_IMAGE}" \
+              --platform "${RENOVATE_PLATFORM}" \
+              --endpoint "${RENOVATE_ENDPOINT}" \
+              --git-author "${RENOVATE_GIT_AUTHOR}" \
+              --onboarding="${RENOVATE_ONBOARDING}" \
+              --require-config "${RENOVATE_REQUIRE_CONFIG}" \
+              --pr-concurrent-limit "${RENOVATE_PR_CONCURRENT_LIMIT}" \
+              --branch-concurrent-limit "${RENOVATE_BRANCH_CONCURRENT_LIMIT}" \
+              DarkHelm.org/plex-playlist
+          }
+
+          if run_renovate_with_endpoint "${BASE_ENDPOINT}" 2>&1 | tee /tmp/renovate.log; then
+            :
+          else
+            echo "⚠ Renovate run failed with primary endpoint. Retrying with API endpoint form..."
+            run_renovate_with_endpoint "${API_ENDPOINT}" 2>&1 | tee /tmp/renovate.log
+          fi
 
           echo "✓ Renovate execution completed"