fix(workflows): retry nix-hashes compute-hash on transient failure (#30743)

.github/workflows/nix-hashes.yml

@@ -56,14 +56,24 @@ jobs:
           BUILD_LOG=$(mktemp)
           trap 'rm -f "$BUILD_LOG"' EXIT
 
-          # Build with fakeHash to trigger hash mismatch and reveal correct hash
-          nix build ".#packages.${SYSTEM}.node_modules_updater" --no-link 2>&1 | tee "$BUILD_LOG" || true
+          HASH=""
+          MAX_ATTEMPTS=3
+          for ((ATTEMPT = 1; ATTEMPT <= MAX_ATTEMPTS; ATTEMPT++)); do
+            # Build with fakeHash to trigger hash mismatch and reveal correct hash
+            nix build ".#packages.${SYSTEM}.node_modules_updater" --no-link 2>&1 | tee "$BUILD_LOG" || true
 
-          # Extract hash from build log with portability
-          HASH="$(nix run --inputs-from . nixpkgs#gnugrep -- -oP 'got:\s*\Ksha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | tail -n1 || true)"
+            HASH="$(nix run --inputs-from . nixpkgs#gnugrep -- -oP 'got:\s*\Ksha256-[A-Za-z0-9+/=]+' "$BUILD_LOG" | tail -n1 || true)"
+
+            [ -n "$HASH" ] && break
+
+            if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+              echo "::warning::Attempt ${ATTEMPT}/${MAX_ATTEMPTS} produced no hash for ${SYSTEM}; retrying in $((ATTEMPT * 10))s"
+              sleep $((ATTEMPT * 10))
+            fi
+          done
 
           if [ -z "$HASH" ]; then
-            echo "::error::Failed to compute hash for ${SYSTEM}"
+            echo "::error::Failed to compute hash for ${SYSTEM} after ${MAX_ATTEMPTS} attempts"
             cat "$BUILD_LOG"
             exit 1
           fi