Retry clone and docker build against transient runner network flakes

CI runners intermittently lose egress (DNS SERVFAILs, refused connects to
the git server), which killed builds on transient failures. Retry the
checkout clone (3 attempts, 10/20s backoff) and the docker build
(BuildKit layer cache makes a retry cheap) before failing the job.

checkout/action.yaml

@@ -20,9 +20,27 @@ runs:
   steps:
     - shell: bash
       run: |
-        if [ "${{ inputs.depth }}" = "0" ]; then
-          git clone "https://oauth2:${{ inputs.token }}@git.flowmade.one/${{ inputs.repository }}.git" .
-        else
-          git clone --depth "${{ inputs.depth }}" --branch "${{ inputs.ref }}" \
-            "https://oauth2:${{ inputs.token }}@git.flowmade.one/${{ inputs.repository }}.git" .
-        fi
+        URL="https://oauth2:${{ inputs.token }}@git.flowmade.one/${{ inputs.repository }}.git"
+        clone() {
+          if [ "${{ inputs.depth }}" = "0" ]; then
+            git clone "$URL" .
+          else
+            git clone --depth "${{ inputs.depth }}" --branch "${{ inputs.ref }}" "$URL" .
+          fi
+        }
+
+        # Runner egress is flaky (transient DNS/connection failures to the git
+        # server); retry with backoff before failing the job.
+        ok=0
+        for attempt in 1 2 3; do
+          if clone; then
+            ok=1
+            break
+          fi
+          if [ "$attempt" -eq 3 ]; then
+            break
+          fi
+          echo "clone failed, retrying in $((attempt * 10))s..."
+          sleep $((attempt * 10))
+        done
+        [ "$ok" -eq 1 ] || exit 1