Retry GetBuildInfo to absorb Artifactory index propagation lag

[agrasth]

Summary

• pm-version-monitor's pnpm compatibility test runs showed a sharp, date-correlated pass-rate collapse (100% → ~25%) on days with heavy concurrent CI load — spread evenly across every pnpm line including the officially-supported 10.x baseline, so it wasn't a pnpm-version issue at all.
• Every failure shared the same signature: Error: Should be true / Messages: Build info was not found, immediately after a successful jfrog rt bp publish.
• Root cause: tests.GetBuildInfo queried Artifactory right after the publish call returned success, with no retry. BuildInfoService.GetBuildInfo's own doc comment confirms a 404 surfaces as (found=false, err=nil) — exactly the shape of "published, but the search index hasn't caught up yet," which gets more likely the more concurrent CI load hits the same Artifactory instance.
• Add a short bounded retry (4 attempts, 500ms exponential backoff, ~7.5s worst case) inside GetBuildInfo itself, so all ~20 call sites across pnpm_test.go, npm_test.go, maven_test.go, etc. benefit without touching each one individually. Only the found=false, err=nil case retries — any real error still returns immediately, unchanged from today's behavior.

Test plan

• go build ./... — succeeds
• go vet ./utils/tests/... — clean
• Traced the exact failing runs from pm-version-monitor's pnpm dashboard (August 20 mass-retest window) back to this call site and confirmed the signature matches on every one
• Confirmed via BuildInfoService.GetBuildInfo's doc comment in jfrog-client-go that found=false, err=nil is the documented 404 signal, so retrying only that case is safe and won't mask real failures

[github-actions]

View full scan results in JFrog Platform

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 1 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	Not Found
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	1 Issues Found 1 High
Secrets	✅ Done	Not Found
Infrastructure as Code (IaC)	✅ Done	Not Found

---

🐸 JFrog Frogbot

[github-actions]

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
High	TLS settings are configured insecurely, exposing communications to risks

Full description

Vulnerability Details

Rule ID:	go-insecure-tls

Overview

Insecure TLS Configuration is a type of vulnerability that occurs when an
application uses weak or outdated cryptographic protocols, ciphers, or
configurations for secure communication over the network.

Vulnerable example

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
        config.MinVersion = 0
    }
    {
        config := &tls.Config{}
        config.MinVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
        config.MaxVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
            tls.TLS_RSA_WITH_RC4_128_SHA,
        },
    }
    _ = config
}

In this example, the MinVersion field is set to tls.VersionSSL30, which
uses the outdated SSL 3.0 protocol, making the application vulnerable to
attacks such as POODLE.

Remediation

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
-       config.MinVersion = 0
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MinVersion = tls.VersionSSL30
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MaxVersion = tls.VersionSSL30
    }
    {
-       config := &tls.Config{}
+       config := &tls.Config{MinVersion: tls.VersionTLS12}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
-           tls.TLS_RSA_WITH_RC4_128_SHA,
+           tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
+       MinVersion: tls.VersionTLS12,
    }
    _ = config
}

By using safe TLS versions (e.g., tls.VersionTLS12) and secure cipher suites we can
mitigate the risk of insecure TLS configurations and improve the security of the
application.

---

🐸 JFrog Frogbot