Add retry logic with exponential backoff for transient failures

[Copilot]

Witness commands intermittently fail with ECONNREFUSED errors when subprocesses (e.g., npm ci) encounter transient network issues. Re-running typically succeeds, indicating these are temporary failures that should be handled automatically.

Changes

Core Implementation

• Added executeWithRetry() wrapper around exec.exec() with exponential backoff (5s → 10s → 20s...)
• Logs attempt number and error message on each retry before final failure

Configuration

• New retries input (default: 2) - maximum retry attempts
• New retry-delay input (default: 5) - initial delay in seconds before exponential backoff

Usage

- uses: testifysec/witness-run-action@v1
  with:
    step: build
    command: npm ci
    retries: 3          # 4 total attempts
    retry-delay: 10     # 10s → 20s → 40s

Defaults provide automatic recovery from transient failures without configuration.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>fix: sometimes witness-run-action fails to connect to archivista</issue_title>
<issue_description>## Current behavior

Intermittently, when using witness-run-action in a github action, it will fail to connect to archivista with a ECONNREFUSED. Re-running the job usually will work on next attempt.

Run testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
Running in directory /home/runner/work/judge/judge
/usr/bin/sh -c witness run -a=environment -a=git -a=github --enable-archivista=true --fulcio=https://fulcio.sigstore.dev --fulcio-oidc-client-id=https://oauth2.sigstore.dev/auth --fulcio-oidc-issuer=sigstore --product-excludeGlob={web/node_modules/**,node_modules/**} -s=install --timestamp-servers=https://freetsa.org/tsr --trace=false --outfile=/tmp/install-attestation.json -- npm ci
level=info msg="Starting environment attestor..."
level=info msg="Starting git attestor..."
level=info msg="Starting github attestor..."
(string) (len=1844) "***"
level=info msg="Starting material attestor..."
level=info msg="Starting command-run attestor..."
npm ERR! code ECONNREFUSED
npm ERR! syscall connect
npm ERR! errno -[11](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:12)1
npm ERR! Error: connect ECONNREFUSED 104.16.29.34:443
npm ERR!     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16)
npm ERR!  Error: connect ECONNREFUSED 104.16.29.34:443
npm ERR!     at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1555:16) {
npm ERR!   errno: -111,
npm ERR!   code: 'ECONNREFUSED',
npm ERR!   syscall: 'connect',
npm ERR!   address: '104.16.29.34',
npm ERR!   port: 443
npm ERR! }
npm ERR! 
npm ERR! If you are behind a proxy, please make sure that the
npm ERR! 'proxy' config is set properly.  See: 'npm help config'

npm ERR! A complete log of this run can be found in: /home/runner/.npm/_logs/2024-02-05T20_40_10_154Z-debug-0.log
level=error msg="Error running command-run attestor: exit status 145"
level=error msg="failed to run attestors: exit status 145"
/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb665[13](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:14)c03b934/node_modules/@actions/exec/lib/toolrunner.js:592
                error = new Error(`The process '${this.toolPath}' failed with exit code ${this.processExitCode}`);
                        ^

Error: The process '/usr/bin/sh' failed with exit code 1
    at ExecState._setResult (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:592:25)
    at ExecState.CheckComplete (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:575:18)
    at ChildProcess.<anonymous> (/home/runner/work/_actions/testifysec/witness-run-action/40aa4ef36fc431a37de7c3faebcb66513c03b934/node_modules/@actions/exec/lib/toolrunner.js:469:27)
    at ChildProcess.emit (node:events:513:28)
    at maybeClose (node:internal/child_process:1100:[16](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:17))
    at Process.ChildProcess._handle.onexit (node:internal/child_process:[30](https://github.com/testifysec/judge/actions/runs/7790572883/job/21244726644#step:4:31)4:5)

Expected behavior

witness-run-action witness connects to archivista without a ECONNREFUSED

let's implement github.com/kriscoleman/goretry to retry on transient errors.
we can use the convenience patterns so it's human readable
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes fix: sometimes witness-run-action fails to connect to archivista #10

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.