retry http requests (#197)

* retry http requests

Implement simple request retrying to redue the probabiliyt that a single
GET receiving a 503 will cause a whole CI job to need to be retried.

Use hashicorp/go-retryablehttp since it fits this very simple use case
well.

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

* lint fix: remove unused nolints

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

---------

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>

Author: willmurphyscode

go.mod

@@ -23,6 +23,7 @@ require (
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/google/yamlfmt v0.20.0
 	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/itchyny/gojq v0.12.17
 	github.com/jedib0t/go-pretty v4.3.0+incompatible
 	github.com/mholt/archiver/v3 v3.5.1
@@ -78,6 +79,7 @@ require (
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/gookit/color v1.5.4 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/iancoleman/strcase v0.3.0 // indirect

go.sum

@@ -131,6 +131,8 @@ github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.m
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
 github.com/fatih/set v0.2.1 h1:nn2CaJyknWE/6txyUDGwysr3G5QC6xWB/PtVjPBbeaA=
 github.com/fatih/set v0.2.1/go.mod h1:+RKtMCH+favT2+3YecHGxcc0b4KyVWA1QWWJUs4E0CI=
 github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
@@ -244,9 +246,15 @@ github.com/gookit/color v1.5.4/go.mod h1:pZJOeOS8DM43rXbp4AZo1n9zCU2qjpcRko0b6/Q
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=

internal/download_file.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/go-git/go-git/v5/plumbing/hash"
+	"github.com/hashicorp/go-retryablehttp"
 
 	"github.com/anchore/go-logger"
 )
@@ -53,7 +54,7 @@ func DownloadFile(lgr logger.Logger, url string, filepath string, checksum strin
 }
 
 func DownloadURL(lgr logger.Logger, url string) (io.ReadCloser, error) {
-	resp, err := http.Get(url) //nolint: gosec  // we must be able to get arbitrary URLs
+	resp, err := retryablehttp.Get(url)
 	if err != nil {
 		return nil, fmt.Errorf("unable to download %q: %w", url, err)
 	}

tool/githubrelease/installer.go

@@ -17,7 +17,6 @@ import (
 	"github.com/scylladb/go-set/strset"
 	"github.com/shurcooL/githubv4"
 	"golang.org/x/net/html"
-	"golang.org/x/oauth2"
 
 	"github.com/anchore/binny"
 	"github.com/anchore/binny/internal"
@@ -822,18 +821,13 @@ func processExpandedAssets(lgr logger.Logger, reader io.Reader, from string) []g
 	return assets
 }
 
-//nolint:funlen
 func fetchReleaseGithubV4API(user, repo, tag string) (*ghRelease, error) {
 	token := os.Getenv("GITHUB_TOKEN")
 	if token == "" {
 		return nil, fmt.Errorf("GITHUB_TOKEN environment variable not set but is required to use the GitHub v4 API")
 	}
-	src := oauth2.StaticTokenSource(
-		// TODO: DI this
-		&oauth2.Token{AccessToken: token},
-	)
-	httpClient := oauth2.NewClient(context.Background(), src)
-	client := githubv4.NewClient(httpClient)
+
+	client := githubv4.NewClient(newRetryableGitHubClient(token))
 
 	// TODO: act on hitting a rate limit
 	type rateLimit struct {

tool/githubrelease/retry_test.go

@@ -0,0 +1,40 @@
+package githubrelease
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewRetryableGitHubClient_RetriesWithAuthHeader(t *testing.T) {
+	var requests int
+	var authHeaders []string
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests++
+		authHeaders = append(authHeaders, r.Header.Get("Authorization"))
+
+		if requests < 3 {
+			w.WriteHeader(http.StatusServiceUnavailable)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	token := "test-token-12345"
+	client := newRetryableGitHubClient(token)
+
+	resp, err := client.Get(server.URL)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	assert.Equal(t, 3, requests, "expected 3 requests (2 retries)")
+	expectedAuth := "Bearer " + token
+	for i, auth := range authHeaders {
+		assert.Equal(t, expectedAuth, auth, "request %d missing auth header", i+1)
+	}
+}

tool/githubrelease/version_resolver.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/Masterminds/semver/v3"
+	"github.com/hashicorp/go-retryablehttp"
 	"github.com/shurcooL/githubv4"
 	"golang.org/x/oauth2"
 
@@ -209,19 +210,15 @@ func fetchLatestReleaseFromGithubFacade(user, repo string) (*ghRelease, error) {
 }
 
 func downloadJSON(url string) (*http.Response, error) {
-	headers := map[string]string{"Accept": "application/json"}
+	client := retryablehttp.NewClient()
+	client.HTTPClient.Timeout = 10 * time.Second
+	client.Logger = nil
 
-	client := &http.Client{
-		Timeout: time.Second * 10,
-	}
-	req, err := http.NewRequest(http.MethodGet, url, nil)
+	req, err := retryablehttp.NewRequest(http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
 	}
-
-	for key, value := range headers {
-		req.Header.Set(key, value)
-	}
+	req.Header.Set("Accept", "application/json")
 
 	resp, err := client.Do(req)
 	if err != nil {
@@ -233,18 +230,26 @@ func downloadJSON(url string) (*http.Response, error) {
 	return resp, nil
 }
 
+// newRetryableGitHubClient creates an HTTP client with OAuth2 authentication and retry logic.
+func newRetryableGitHubClient(token string) *http.Client {
+	src := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: token})
+	oauth2Client := oauth2.NewClient(context.Background(), src)
+
+	retryClient := retryablehttp.NewClient()
+	retryClient.HTTPClient.Transport = oauth2Client.Transport
+	retryClient.Logger = nil
+
+	return retryClient.StandardClient()
+}
+
 //nolint:funlen
 func fetchAllReleasesFromGithubV4API(user, repo string) ([]ghRelease, error) {
 	token := os.Getenv("GITHUB_TOKEN")
 	if token == "" {
 		return nil, fmt.Errorf("GITHUB_TOKEN environment variable not set but is required to use the GitHub v4 API")
 	}
-	src := oauth2.StaticTokenSource(
-		// TODO: DI this
-		&oauth2.Token{AccessToken: token},
-	)
-	httpClient := oauth2.NewClient(context.Background(), src)
-	client := githubv4.NewClient(httpClient)
+
+	client := githubv4.NewClient(newRetryableGitHubClient(token))
 	var allReleases []ghRelease
 
 	// Query some details about a repository, an ghIssue in it, and its comments.

tool/goproxy/version_resolver.go

@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/hashicorp/go-retryablehttp"
+
 	"github.com/anchore/binny"
 	"github.com/anchore/binny/internal"
 	"github.com/anchore/binny/internal/log"
@@ -102,7 +104,7 @@ func availableVersionsFetcher(url string) ([]string, error) {
 
 	log.WithFields("url", url).Trace("requesting latest version")
 
-	resp, err := http.Get(url) //nolint:gosec
+	resp, err := retryablehttp.Get(url)
 	if err != nil {
 		return nil, err
 	}