Fix sbt docker e2e flake on Maven Central blips

[Mikola Lysenko (mikolalysenko)]

Problem

The sbt / Mill / scala-cli compatibility workflow keeps going red on PRs that don't touch sbt. Each time it's one random agent or Mill leg, while its sibling legs on the same commit pass. Four such failures on 2026-10-08:

run	branch	leg	failing step
37806411423	agent/fix-npm-open-issues	sbt 1.13.0 / jdk 21 / agent	under 1 s
37805974894	arch-refactor/808-apply-lock-interrupt-cleanup	mill 0.12.17	about 1 s
37805974894	same run	sbt 1.9.9 / jdk 17 / agent	11 s
37770254778	main (push)	sbt 1.13.0 / jdk 17 / agent	under 1 s

In each of these legs, every docker_e2e_sbt test fails within 0.1 to 10 s. That's before any docker run happens, and a real cell takes minutes. The sbt image had just been loaded ("Loaded image: socket-patch-test-sbt:latest"). Each failure costs a full re-run of a heavy leg: the leg downloads a 1.7 GB image artifact, about 2.5 min. It also leaves PR checks red, which slows review.

Root cause

Before it starts a container, run_cell calls jars(), which fetches commons-text 1.9 and its .sha1 from the real repo1.maven.org through a bare reqwest::Client::new(). A transport error or a non-2xx status panics on the spot, with no retry and no timeout. So a single DNS, connect or reset blip, or a 5xx/429 from Central's CDN, fails every test in the leg at once. That matches the sub-second and 10 s (connect timeout) signatures above.

The workflow can't show this directly: scripts/sbt-compat-matrix.sh redirects the test output to a log that is uploaded only as an artifact. The job log just says FAIL docker_e2e_sbt[...] <test>.

Fix

• docker_e2e_sbt.rs: fetch_from_central retries up to 5 times (1+2+4+8 s backoff), only on transport errors and 429/5xx. Any other status (e.g. a 404) still fails on the first attempt with the same message as before. The client also gets a 60 s request timeout, so a stalled transfer is retried instead of hanging the leg. This is a narrow retry on a network fetch outside the code under test; the patch/rollback/sidecar assertions are unchanged.
• sbt-compat-matrix.sh: report() prints the last 60 lines of a failing log into a collapsed ::group:: in the job log. That includes the "no test ran" case, which used to return before printing anything. It uses a per-call flag, so a passing call after a failing one (the scala-cli group runs two) doesn't dump its log.

The hunk in docker_e2e_sbt.rs is kept clear of the one #1124 changes (git_sha256), so the two merge cleanly.

Proof

• I used a temporary test (not committed) to drive fetch_from_central against wiremock. 503, 503, 200 returns the body after 3 requests. Connection refused retries 5 times, then panics. 404 fails after 1 request, with no retry. Also, jars() against the real Central passes. Result: 2 passed.
• I fed report() fake logs (pass, fail, no-test-ran, and pass after a fail). PASS/FAIL lines are unchanged, STATUS is set as before, and the tail prints only for the failing calls.
• cargo clippy -p socket-patch-cli --features docker-e2e --test docker_e2e_sbt -- -D warnings: clean. rustfmt --check on the touched file: clean. bash -n on the script: OK.
• This PR touches both paths, so the sbt workflow runs on it and exercises every agent/Mill leg against real Central.

Where tests run

No test is removed, moved or weakened. The sbt compatibility workflow keeps its triggers (PR paths, push to main, nightly).

🤖 Generated with Claude Code

https://claude.ai/code/session_01E35LYStnEzhojF7DU3rP8M

---

Generated by Claude Code

---

Note

Low Risk
Test harness and CI reporting only; no production patch or agent behavior changes.

Overview
Reduces sbt / Mill docker e2e flakes when CI hits transient Maven Central issues, and makes matrix failures easier to debug in the job log.

In docker_e2e_sbt, fixture setup (jars()) now uses a 60s request timeout and a shared fetch_from_central helper that retries up to 5 times with exponential backoff on transport errors, 429, and 5xx; other HTTP statuses still fail on the first response. Patch/rollback assertions are unchanged.

In sbt-compat-matrix.sh, report() still emits PASS/FAIL/SKIP the same way, but on any failure (including “no test ran”) it prints the last 60 lines of the log in a collapsed GitHub ::group::, using a per-call failed flag so a later passing report does not dump its log.

^{Reviewed by Cursor Bugbot for commit 54432af. Configure here.}

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 54432af. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Burn-down agent: labeled Ready for review at head 54432af469.

• CI: all checks on the head are green (ci-ok success, every sbt agent and Mill leg passed, 0 failing, 0 pending).
• Bugbot reviewed 54432af and found nothing. There are no open review threads.
• Mergeable: clean.
• For the reviewer: the change is test-harness only (Central fetch retry and timeout, plus a failure-log tail in sbt-compat-matrix.sh).

---

Generated by Claude Code