fix(ci): fail fast on non-transient errors during source wait

The pre-flight source-digest wait was treating every oras fetch failure as a
transient miss, so a genuine non-transient error (auth, bad reference) would
poll for the full 10-minute timeout. `OrasWaitForSourcesWorkflow._is_available`
now re-raises non-transient `BakeryToolRuntimeError`s instead of returning
False, and `publish()` catches them to surface a clean `typer.Exit(1)` with the
oras stderr rather than letting an unhandled traceback escape.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ianpittwood

posit-bakery/posit_bakery/cli/ci.py

@@ -294,6 +294,7 @@ def publish(
     """
     # Imports kept local to mirror existing patterns and to avoid bloating
     # module load time when this command isn't invoked.
+    from posit_bakery.error import BakeryToolRuntimeError
     from posit_bakery.plugins.builtin.oras.oras import (
         OrasIndexCopyWorkflow,
         OrasIndexCreateWorkflow,
@@ -365,10 +366,17 @@ def publish(
     all_sources = sorted({s for t in targets for s in t.get_merge_sources()})
     if all_sources:
         log.info(f"Waiting for {len(all_sources)} source digest(s) to be readable before publishing.")
-        wait = OrasWaitForSourcesWorkflow(
-            oras_bin=oras_bin,
-            sources=all_sources,
-        ).run(dry_run=dry_run)
+        try:
+            wait = OrasWaitForSourcesWorkflow(
+                oras_bin=oras_bin,
+                sources=all_sources,
+            ).run(dry_run=dry_run)
+        except BakeryToolRuntimeError as e:
+            # A non-transient registry error (auth, bad reference, ...) while
+            # probing sources is fatal and won't self-heal — surface it cleanly
+            # rather than letting it escape as an unhandled traceback.
+            log.error(f"Failed while waiting for source digests: {e.dump_stderr() or e}")
+            raise typer.Exit(code=1)
         if not wait.success:
             log.error(f"Source digests not available: {wait.error}")
             raise typer.Exit(code=1)

posit-bakery/posit_bakery/plugins/builtin/oras/oras.py

@@ -11,7 +11,7 @@
 
 from posit_bakery.error import BakeryToolRuntimeError
 from posit_bakery.image.image_target import ImageTarget, Tag
-from posit_bakery.retry import RetryPolicy, retry_on_transient
+from posit_bakery.retry import RetryPolicy, is_transient_error, retry_on_transient
 from posit_bakery.util import find_bin
 
 log = logging.getLogger(__name__)
@@ -366,8 +366,10 @@ def _is_available(self, ref: str) -> bool:
                 plain_http=self.plain_http,
             ).run(dry_run=False)
             return True
-        except BakeryToolRuntimeError:
-            return False
+        except BakeryToolRuntimeError as e:
+            if is_transient_error(e):
+                return False
+            raise
 
     def run(
         self,

posit-bakery/test/cli/test_ci_publish.py

@@ -165,3 +165,43 @@ def test_publish_aborts_when_sources_never_ready(tmp_path):
     assert result.exit_code == 1
     # Aborted before SOCI convert.
     fake_soci.execute.assert_not_called()
+
+
+def test_publish_surfaces_clean_error_on_non_transient_wait_failure(tmp_path):
+    """A non-transient registry error during the wait exits cleanly (code 1)
+    rather than escaping as an unhandled traceback."""
+    from posit_bakery.error import BakeryToolRuntimeError
+
+    sources = ["ghcr.io/posit-dev/test/tmp@sha256:amd64"]
+    target = _fake_target("uid1", merge_sources=sources)
+    target.settings.temp_registry = "ghcr.io/posit-dev"
+
+    fake_config = MagicMock()
+    fake_config.base_path = tmp_path
+    fake_config.load_build_metadata_from_file.return_value = ["uid1"]
+    fake_config.get_image_target_by_uid.return_value = target
+
+    fake_wait_instance = MagicMock()
+    fake_wait_instance.run.side_effect = BakeryToolRuntimeError(
+        message="oras command failed",
+        tool_name="oras",
+        cmd=["oras", "manifest", "fetch"],
+        stdout=b"",
+        stderr=b"unauthorized: authentication required",
+    )
+
+    fake_soci = MagicMock()
+
+    runner = CliRunner()
+    with (
+        patch("posit_bakery.cli.ci.BakeryConfig.from_context", return_value=fake_config),
+        patch("posit_bakery.plugins.builtin.oras.oras.find_oras_bin", return_value="oras"),
+        patch("posit_bakery.plugins.builtin.oras.oras.OrasWaitForSourcesWorkflow", return_value=fake_wait_instance),
+        patch("posit_bakery.plugins.registry.get_plugin", return_value=fake_soci),
+    ):
+        result = runner.invoke(app, ["ci", "publish", "meta.json"], env=_WIDE_TERM_ENV)
+
+    # Clean exit, not an unhandled exception.
+    assert result.exit_code == 1
+    assert result.exception is None or isinstance(result.exception, SystemExit)
+    fake_soci.execute.assert_not_called()

posit-bakery/test/plugins/builtin/oras/test_oras.py

@@ -951,6 +951,29 @@ def sleep(seconds):
         assert result.missing == ["ghcr.io/posit-dev/test/tmp@sha256:b"]
         assert "still unreadable" in result.error
 
+    def test_non_transient_error_raises_immediately(self):
+        """A non-transient fetch error (e.g. auth) must not be polled on — it
+        raises right away instead of burning the full timeout."""
+        wf = OrasWaitForSourcesWorkflow(
+            oras_bin="oras",
+            sources=["ghcr.io/posit-dev/test/tmp@sha256:a"],
+            poll_interval=5.0,
+            timeout=600.0,
+        )
+        sleep = MagicMock()
+
+        def side_effect(cmd, capture_output):
+            return subprocess.CompletedProcess(
+                args=cmd, returncode=1, stdout=b"", stderr=b"unauthorized: authentication required"
+            )
+
+        with patch("subprocess.run", side_effect=side_effect):
+            with pytest.raises(BakeryToolRuntimeError):
+                wf.run(sleep=sleep, now=lambda: 0.0)
+
+        # Failed fast: no backoff sleep, no waiting for the timeout.
+        sleep.assert_not_called()
+
     def test_dry_run_skips_polling(self):
         wf = OrasWaitForSourcesWorkflow(oras_bin="oras", sources=["ghcr.io/posit-dev/test/tmp@sha256:a"])
         with patch("subprocess.run") as mock_run: