BUILD-10777 Add retry with exponential backoff for OIDC and Cognito auth

[mikolaj-matuszny-ext-sonarsource]

Summary

• Add generic retryWithBackoff() utility with exponential backoff and jitter
• Wrap all three external calls in getCognitoCredentials with retry: GitHub OIDC token, Cognito GetId, Cognito GetCredentialsForIdentity
• Each call retries independently — a Cognito failure doesn't re-fetch the OIDC token

Fixes transient Rate exceeded failures observed in CI (BUILD-10777).

Backoff behavior

Defaults: 3 attempts, 5000ms base delay, exponential with jitter (50-100% of base).

Jitter prevents thundering herd when many concurrent runners retry simultaneously after a transient Cognito rate limit.

Attempt	Base delay	With jitter (range)
1st retry	5000ms	2.5s – 5s
2nd retry	10000ms	5s – 10s

Example: a workflow with 20 matrix jobs hits Cognito simultaneously. Without jitter, all 20 retry at exactly 5s, hitting the rate limit again. With jitter, retries spread across 2.5-5s, reducing contention.

Example log output on transient Cognito rate limit:

Warning: Cognito GetId failed (attempt 1/3): Rate exceeded. Retrying in 3842ms...
Info: Exchanging OIDC token for Cognito identity...
Info: Obtaining AWS credentials from Cognito...
Info: AWS credentials configured successfully

Defaults are configurable via AuthConfig.retryOptions (maxAttempts, baseDelayMs).

Changes

File	Description
src/retry.ts	New generic retry utility with exponential backoff + jitter
src/auth.ts	Wrap OIDC and Cognito calls with retry
__tests__/retry.test.ts	4 tests for retry utility
__tests__/auth.test.ts	4 tests for transient failure recovery
__tests__/credential-setup.test.ts	Mock retry delays for fast tests

Test plan

• 8 new tests covering retry success, retry exhaustion, and each call point
• All 23 tests pass in ~560ms
• Verify in CI that transient OIDC/Cognito failures are retried (check logs for retry warnings)

🤖 Generated with Claude Code

[sonar-review-alpha]

Summary

Adds exponential backoff retry logic to handle transient OIDC and Cognito rate-limit failures. Wraps three independent external calls (GitHub OIDC token fetch, Cognito GetId, Cognito GetCredentials) with a new retryWithBackoff() utility that uses crypto.randomInt() for jitter to prevent thundering herd. Each call retries independently with its own label—a Cognito failure doesn't re-attempt the OIDC token fetch. Includes 8 new tests; all 23 tests pass in ~560ms.

What reviewers should know

Start with src/retry.ts to understand the core backoff logic (exponential 2^n with 50-100% jitter applied on each attempt). Then review src/auth.ts to see how each of the three external calls is wrapped—note the retryOpts spread on lines 27, 39-40, and 53 to preserve caller-supplied retryOptions. Watch for the intentional independence: each wrapped call has its own attempt counter, so one failure doesn't restart another's attempts. Check test mocks in __tests__/credential-setup.test.ts (line 6-10): delays are mocked to 1ms globally to keep tests fast. The new auth tests (lines 83-172) validate retry success paths; the existing auth tests remain unchanged and still pass.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-agent]

SonarQube Remediation Agent

SonarQube found 6 issues in this PR that the agent can fix for you. Est. time saved: ~30 min

6 issues found

• 🟠 No magic number: 3. — auth.test.ts:136
• 🟠 No magic number: 3. — auth.test.ts:162
• 🟠 No magic number: 3. — auth.test.ts:172
• 🟠 No magic number: 1100. — retry.test.ts:35
• 🟠 No magic number: 1100. — retry.test.ts:54
• 🟠 No magic number: 4000. — retry.test.ts:75

• Run Remediation Agent
  Select the checkbox above to enable this action.

View Project in SonarCloud

💡 Got issues in your backlog? Let the agent fix them for you.

[sonarqube-cloud-us]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

LGTM! ✅

Clean implementation with a well-designed retry abstraction, correct jitter math, and thorough test coverage. Good to merge.

🗣️ Give feedback