[Mikola Lysenko (mikolalysenko)]

Problem

denoland/setup-deno downloads Deno from a github.com release and gives up after three tries in about 30 s. On 2026-11-09 the same release-CDN 504 outage that failed the nightly (run 42568829044) also failed the e2e (ubuntu-latest, e2e_vex_build, ... deno:: --ignored) leg on #2018 (run 42571326428, job 129009602302): three Unexpected HTTP response: 504 between 06:12:05 and 06:12:47, then ##[error]. That turned ci-ok red on a PR whose code had nothing to do with it. In the merge queue the same thing would evict the entry.

The other 504-exposed steps from that outage are already handled in open PRs: setup-ruby (#2041), the lint-ecosystems installers (#2040) and vexctl (#2039). None of them touch setup-deno.

Root cause

setup-deno retries only briefly, so a release-CDN outage of a few minutes fails the step.

Fix

Run Setup Deno (attempt 1) capped at 4 min with continue-on-error: true. Then run Setup Deno (attempt 2) as the very next step, with no tolerance, only when attempt 1 failed. This is the same shape as the other retried setup steps. scripts/tests/test_merge_queue_fail_fast.py enforces it: same uses: SHA, steps.<id>.outcome != 'success' guard, and no continue-on-error on the retry. If the second attempt also fails, the leg still fails.

Both matrix.deno legs (the PR-tier 2.9.7 row and the full-tier 1.46.3 row) use this step.

Proof

• python3 -m unittest discover -s scripts/tests: 411 tests pass, including the CiWorkflowContract checks on attempt-1/attempt-2 pairs.
• scripts/check-tool-pins.py .github/workflows/ci.yml reports no ci.yml violations. The 7 it reports in *-compatibility.yml were already on main.
• The YAML parses. actionlint and zizmor aren't installed in this environment.

Tests moved or removed

None. The diff is one file (ci.yml) and its hunk doesn't overlap #2039, #2040 or #2041.

---

Generated by Claude Code

---

Note

Low Risk
CI workflow-only hardening for flaky Deno downloads; no product code, auth, or data paths change.

Overview
Adds a two-step Deno install in the e2e job template so transient GitHub release 504s no longer fail Deno matrix legs after denoland/setup-deno exhausts its short internal retries.

Setup Deno (attempt 1) gets a 4-minute cap and continue-on-error: true; Setup Deno (attempt 2) runs immediately afterward only when attempt 1 did not succeed, with the same pinned action and version but no tolerance on failure. This matches the existing retry shape used for steps like Setup Python and is what test_merge_queue_fail_fast.py expects for attempt pairs.

^{Reviewed by Cursor Bugbot for commit 899f9f5. Configure here.}

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 899f9f5. Configure here.}

[Mikola Lysenko (mikolalysenko)]

Ready for review at 899f9f5.

• CI: 32/32 green (19 skipped by path/matrix gating), no main-wide failures.
• Bugbot: reviewed 899f9f5, no findings.
• Reviewer note: touches only the Setup Deno step in ci.yml; attempt 2 is the very next step (required by test_merge_queue_fail_fast.py) and has no continue-on-error. Also edits ci.yml like Cache vexctl on every OS so release 504s can't fail coverage #2039/Retry release 504s in lint-ecosystems installer steps #2040/Retry setup-ruby once so release 504s can't fail Ruby legs #2041 but in a separate region.

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

Final review brief

What it does: Splits the e2e job's Setup Deno step into two attempts. Attempt 1 is capped at 4 min and continue-on-error; attempt 2 runs only if attempt 1 didn't succeed, so a short github.com release-CDN 504 can't fail a Deno leg, while a second failure still fails the leg.

Risk: low. CI-only, one step in ci.yml; same pattern as #2039/#2040/#2041. If Deno setup really is broken, attempt 2 fails the leg as before (plus up to 4 min).

Look here:

• ci.yml:1796: attempt 1 (id, timeout-minutes: 4, continue-on-error)
• ci.yml:1810: attempt 2 guard, keeps matrix.deno != '' so non-Deno legs still skip both

Verified: read the full diff (17 lines, one file); attempt 2 is the very next step and has no continue-on-error; no other step references the old step name; branch is up to date with main; CHANGELOG.md untouched; scripts/tests/test_merge_queue_fail_fast.py 11/11 pass locally. CI: ci-ok and clippy green on 899f9f5; Bugbot reviewed, no findings; no open review threads.

Changes I made: none.

Auto-merge (squash) is armed, so approving sends it straight to the merge queue.

---

Generated by Claude Code