ci: govulncheck retry self-test races on the tee process substitution #1047

Problem

scripts/test-govulncheck-retry.sh (run in CI's "Build Docker Image" job, step "Run govulncheck retry self-tests") fails intermittently, which fails CI Success on unrelated PRs. Seen twice on 2026-10-16/17:

• FAIL: persistent transient failure fails after 3 attempts (exit 1 want 1, calls 2 want 3) (fix(purchase): re-check purchase constraints on the claimed row before buying #1036, run 38975086669)
• FAIL: transient fetch failures then success pass (exit 1 want 0, calls 2 want 3) (fix(history): hide Retry on executions the backend will never re-drive #967, run 38985088143)

Main's Docker build passes on re-run, so this is a race, not a regression.

Likely cause

scripts/govulncheck-retry.sh copies stderr into $errfile through a process substitution, 2> >(tee "$errfile" >&2), then runs a bare wait before grepping the file. A bare wait is not guaranteed to wait for that process substitution (bash only tracks the last one, and only through $!). When tee has not flushed, grep 'fetching vulnerabilities' "$errfile" sees an empty file, the failure is classed as non-transient and the retry loop stops early. The fewer calls (2 instead of 3) match that.

The same race can affect the real CI run: a genuine transient DB-fetch failure may not be retried.

Fix direction

Write stderr straight to the file and replay it (govulncheck "$@" 2>"$errfile" || rc=$?; cat "$errfile" >&2), or wait on the process substitution's own PID. Prove it by running the self-test in a loop (for example 200 iterations) before and after.