fix(infra): enhance build reliability and security scanning

Makefile

@@ -21,11 +21,11 @@ ACTIONS_PYTHON_VERSIONS ?= 3.13.3-14344076652
 POWERSHELL_VERSION      ?= v7.5.2
 POWERSHELL_NATIVE_VERSION ?= v7.4.0
 UBUNTU_VERSION          ?= 24.04
-TRIVY_VERSION           ?= v0.58.1
+TRIVY_VERSION           ?= v0.68.2
 
 # Security Gates (0 = Log Only, 1 = Fail Build)
-FAIL_ON_CRITICAL        ?= 0
-FAIL_ON_HIGH            ?= 0
+FAIL_ON_CRITICAL        ?= 1
+FAIL_ON_HIGH            ?= 1
 FAIL_ON_MEDIUM          ?= 0
 FAIL_ON_SECRET          ?= 0
 

PowerShell/dotnet-install.py

@@ -14,7 +14,9 @@
 import shutil
 import json
 import urllib.request
+import urllib.error
 import bisect
+import time
 from typing import Optional, List, Tuple, NamedTuple
 
 # Third-party imports
@@ -25,6 +27,8 @@
 GH_REPO = "dotnet-s390x"
 INSTALL_DIR = "/usr/share/dotnet"
 NUGET_PACKAGE = "microsoft.netcore.app.runtime.linux-x64"
+FETCH_MAX_RETRIES = 8
+FETCH_RETRY_DELAY = 5
 
 app = typer.Typer()
 
@@ -172,11 +176,29 @@ def find_closest_version_tag(all_tags: List[dict], input_tag: str) -> str:
 PROFILE_SCRIPT = "/etc/profile.d/dotnet.sh"
 
 def fetch_json(url: str) -> List[dict]:
-    """Download and parse JSON response from a given URL."""
-    with urllib.request.urlopen(url) as response:
-        if response.status >= 400:
-            raise typer.Exit(f"❌ Failed to fetch {url}")
-        return json.loads(response.read())
+    """Download and parse JSON response from a given URL with basic retries."""
+    for attempt in range(FETCH_MAX_RETRIES):
+        try:
+            with urllib.request.urlopen(url) as response:
+                if response.status >= 400:
+                    raise typer.Exit(f"❌ Failed to fetch {url}")
+                return json.loads(response.read())
+        except urllib.error.HTTPError as exc:  # Retry transient HTTP errors
+            if exc.code in [500, 502, 503, 504] and attempt < FETCH_MAX_RETRIES - 1:
+                delay = FETCH_RETRY_DELAY * (2 ** attempt)
+                typer.echo(f"⚠️ HTTP {exc.code} fetching {url}. Retrying in {delay}s... ({attempt + 1}/{FETCH_MAX_RETRIES})")
+                time.sleep(delay)
+                continue
+            raise
+        except Exception as exc:
+            # Catch-all to handle unexpected errors (e.g., network timeouts, DNS failures)
+            # that aren't covered by HTTPError. Ensures retry loop remains robust.
+            if attempt < FETCH_MAX_RETRIES - 1:
+                delay = FETCH_RETRY_DELAY * (2 ** attempt)
+                typer.echo(f"⚠️ Error fetching {url}: {exc}. Retrying in {delay}s... ({attempt + 1}/{FETCH_MAX_RETRIES})")
+                time.sleep(delay)
+                continue
+            raise
 
 def get_all_tags() -> List[dict]:
     """Fetch all release tags from the IBM GitHub repository."""