CI: retry buildah build/push (resilient to transient registry 502s)

scripts/build-image.sh

@@ -19,13 +19,22 @@ cd "$(dirname "$0")/.."
 # Tag with the short git sha when available, else 'dev'.
 TAG="$(git rev-parse --short HEAD 2>/dev/null || echo dev)"
 
+# Retry helper — base-image blob pulls from docker.io/ghcr.io occasionally 502/rate-limit.
+retry() {
+  local n=0 max=4
+  until "$@"; do
+    n=$((n+1)); [ "$n" -ge "$max" ] && { echo ">> failed after ${max} attempts: $*" >&2; return 1; }
+    echo ">> attempt ${n} failed, retrying in $((n*8))s..." >&2; sleep $((n*8))
+  done
+}
+
 echo ">> building ${REF}:${TAG}"
-buildah build --layers -t "${REF}:${TAG}" -t "${REF}:latest" .
+retry buildah build --retry 3 --retry-delay 5s --layers -t "${REF}:${TAG}" -t "${REF}:latest" .
 
 if [[ "${1:-}" == "push" ]]; then
   echo ">> pushing ${REF}:${TAG}"
-  buildah push --digestfile /tmp/bztmon-site.digest "${REF}:${TAG}"
-  buildah push "${REF}:latest"
+  retry buildah push --digestfile /tmp/bztmon-site.digest "${REF}:${TAG}"
+  retry buildah push "${REF}:latest"
   DIGEST="$(cat /tmp/bztmon-site.digest)"
   echo
   echo ">> pin this in home-ops kubernetes/apps/bztmon-site/bztmon-site.yaml:"