Add http retries (like 3) before failing the build

[hfhbd]

I use sigstore to sign my artifacts that are automatically published to MavenCentral. Unfortunately, having 1 single failure during the creation of the signature fails the complete build and I need to restart the whole publishing process, including changing the version number (because of automatic publishing).

Caused by: dev.sigstore.KeylessSignerException: Failed to put entry in rekor
Caused by: org.apache.http.ConnectionClosedException: Premature end of chunk coded message body: closing chunk expected

BuildScan: https://gradle.com/s/coglbxlkoksvu

According to the logs, the rekor server closed the connection. While there is an (temporary) bug in the rekor infrastructure because I can reproduce it, the sigstore gradle plugin should retry the operation instead of failing the build directly.

[loosebazooka]

Oh like try the signing again, yeah that makes sense. We do have retries in rekor I think?

I think you could organize the tasks so signing always happens before any publishing event though.

I think the most gradle compliant way to do this is in the settings file (to be compatible with project isolation), but I haven't tested this out.

rootProject.name = "my-application"
include("app", "core", "shared", "api")

val allSubprojectPaths = rootProject.children.map { it.path }

gradle.beforeProject {
    if (this != rootProject) {
        tasks.matching { it.name.contains("publish", ignoreCase = true) }.configureEach {
            val publishTask = this
            
            // this is the only weird part, where non published modules might cause some sort of failure.
            allSubprojectPaths.forEach { subPath ->
                publishTask.mustRunAfter("$subPath:sigstoreSignFiles")
            }
        }
    }
}