[cgfixit]

Proposed changes

#1709 item 9. The PSScriptAnalyzer (powershell scripts) job in .github/workflows/script-lint.yml failed once on #1710 at Install-Module PSScriptAnalyzer -RequiredVersion 1.23.0 ("No match was found"). That was before any script was analyzed, and a single re-run passed. The step had no retry, so any PowerShell Gallery hiccup turned an unrelated PR red.

The install line is now wrapped in a 3-attempt loop:

• each attempt runs with -ErrorAction Stop;
• back-off is 10s, then 20s;
• after the last attempt it re-throws the original error.

Nothing else changes:

• the 1.23.0 pin;
• the Import-Module and version check after the install, which still fails closed;
• the Invoke step, which still has no rule exclusions.

The worst case adds 30s to a job with a 10-minute timeout.

Option A from #1709. I chose it over caching (B): cache misses would still hit the Gallery, and a cache adds a key to keep in lockstep with the pin.

Invariant / Governance Impact: none. CI workflow only.

Types of changes

• CI / infrastructure (workflows, hooks, templates, or checkers)

Scope: Infrastructure / CI only.

Benefits / why

• A transient Gallery failure no longer fails the job outright, so PRs stop needing manual re-runs.
• Real failures still fail: a wrong version, a missing module, or a Gallery outage across all three tries.

Risks to monitor

• A longer Gallery outage still fails, now about 30s later. That is intended.
• Signal: WARNING: Install-Module attempt N/3 failed: … lines in the job log. If they show up often, consider caching (option B).

Checklist

• I have read docs/THREAT_MODEL.md, INVARIANTS.md and SECURITY.md (and any relevant Phase docs)
• This change preserves all 6 security invariants and I6 module isolation (no code touched)
• Full sandbox validation has been run (per CLAUDE.md §5, left to CI)
• No new external network dependencies or mandatory online LLM assumptions were introduced
• Commit messages follow the title prefix convention above

Further comments

Run directly:

• actionlint: clean.

• zizmor 1.28.0 --offline (the CI pin): no findings.

• The loop itself, extracted from the committed workflow and run under PowerShell 7.4.6 with Install-Module and Start-Sleep stubbed:

  Case	Result
  fails once	warns, waits 10s, installs on call 2, exit 0
  fails 3 times	warns twice (10s, 20s), re-throws the Gallery error, exit 1
  succeeds at once	installs on call 1, exit 0

Not run here: CI uses Windows PowerShell 5.1 (shell: powershell). The loop uses only constructs 5.1 supports (for, try/catch, Write-Warning, Start-Sleep), but this PR's own PSScriptAnalyzer run on Windows is the real check.

Suggested merge order of open PRs

Trial merge verified: no other open PRs; branched from main @ c8ad99a on 2026-10-20.

This PR · Blocked (draft)
Impact: PSScriptAnalyzer install retry.
Action: independent, only open PR. Merge when CI is green.

ELI5

Before checking the PowerShell scripts, a CI job downloads a linter from the PowerShell Gallery. Once, the Gallery briefly said "not found", and the whole check failed even though nothing in the PR was wrong. Now the install step in .github/workflows/script-lint.yml tries up to three times, waiting 10 and then 20 seconds between tries. If all three fail, it still fails with the real error. The rest of the job is untouched: same pinned version, same strict lint.

• Enhances: fewer false reds.
• Makes obsolete: re-running the job by hand after a Gallery blip.
• Retrieves: nothing.
• Pushed to extremes: a slow-failing Gallery costs 30 seconds more before the job goes red.

I ran the retry logic itself under PowerShell 7 with a fake installer. Only Windows CI runs it under 5.1 with the real Gallery.

🤖 Generated with Claude Code

https://claude.ai/code/session_014FZ8JTF2v1eQd1L5CKQR8j

Last updated: 2026-10-20 10:20 ET

---

Generated by Claude Code