fix: watch sync reads the roster through trip membership, image viewer on theme tokens, retry flaky release downloads in CI

.github/workflows/native.yml

@@ -121,18 +121,18 @@ jobs:
         working-directory: client
         run: npm run cap:sync -- ios
 
-      # SwiftPM leaves a half-downloaded binary target (Capacitor's xcframeworks)
-      # behind when a download from GitHub fails, and every later attempt then
-      # stops on "already exists in file system". Resolve on a clean artifact
-      # cache, up to three times, before the build needs the packages.
+      # Capacitor's xcframeworks come from GitHub release downloads, which answer
+      # 504 now and then; SwiftPM then reports the half-written file as "already
+      # exists in file system". Resolve on a clean artifact cache, a few times
+      # with growing pauses, before the build needs the packages.
       - name: Resolve the Swift packages
         working-directory: client/ios/App
         run: |
-          for attempt in 1 2 3; do
+          for attempt in 1 2 3 4 5; do
             rm -rf ~/Library/Caches/org.swift.swiftpm/artifacts
             if xcodebuild -resolvePackageDependencies -project App.xcodeproj -scheme App; then exit 0; fi
-            echo "Resolving the Swift packages failed (attempt $attempt of 3)"
-            sleep 20
+            echo "Resolving the Swift packages failed (attempt $attempt of 5)"
+            sleep $((attempt * 30))
           done
           exit 1
 
@@ -235,18 +235,18 @@ jobs:
           xcrun simctl list runtimes | grep -q watchOS || xcodebuild -downloadPlatform watchOS
           xcrun simctl list runtimes
 
-      # SwiftPM leaves a half-downloaded binary target (Capacitor's xcframeworks)
-      # behind when a download from GitHub fails, and every later attempt then
-      # stops on "already exists in file system". Resolve on a clean artifact
-      # cache, up to three times, before the build needs the packages.
+      # Capacitor's xcframeworks come from GitHub release downloads, which answer
+      # 504 now and then; SwiftPM then reports the half-written file as "already
+      # exists in file system". Resolve on a clean artifact cache, a few times
+      # with growing pauses, before the build needs the packages.
       - name: Resolve the Swift packages
         working-directory: client/ios/App
         run: |
-          for attempt in 1 2 3; do
+          for attempt in 1 2 3 4 5; do
             rm -rf ~/Library/Caches/org.swift.swiftpm/artifacts
             if xcodebuild -resolvePackageDependencies -project App.xcodeproj -scheme App; then exit 0; fi
-            echo "Resolving the Swift packages failed (attempt $attempt of 3)"
-            sleep 20
+            echo "Resolving the Swift packages failed (attempt $attempt of 5)"
+            sleep $((attempt * 30))
           done
           exit 1
 

.github/workflows/test.yml

@@ -1236,10 +1236,12 @@ jobs:
           bin="$RUNNER_TEMP/bin"
           mkdir -p "$bin"
           cd "$RUNNER_TEMP"
-          curl -sSfLo helm.tgz "https://get.helm.sh/helm-$HELM_VERSION-linux-amd64.tar.gz"
+          # GitHub's release downloads answer 504 now and then: retry, the checksum still decides.
+          fetch() { curl -sSfL --retry 5 --retry-delay 15 --retry-all-errors -o "$1" "$2"; }
+          fetch helm.tgz "https://get.helm.sh/helm-$HELM_VERSION-linux-amd64.tar.gz"
           echo "$HELM_SHA256  helm.tgz" | sha256sum -c -
           tar -xzf helm.tgz --strip-components=1 -C "$bin" linux-amd64/helm
-          curl -sSfLo kubeconform.tgz "https://github.com/yannh/kubeconform/releases/download/$KUBECONFORM_VERSION/kubeconform-linux-amd64.tar.gz"
+          fetch kubeconform.tgz "https://github.com/yannh/kubeconform/releases/download/$KUBECONFORM_VERSION/kubeconform-linux-amd64.tar.gz"
           echo "$KUBECONFORM_SHA256  kubeconform.tgz" | sha256sum -c -
           tar -xzf kubeconform.tgz -C "$bin" kubeconform
           echo "$bin" >> "$GITHUB_PATH"