fix(oci): retry transient token requests

[abhinavgautam01]

Summary

Fixes #266.

• Retry OCI Bearer-token requests after transient network and DNS failures.
• Retry rate-limited (429) and server-error (5xx) token responses.
• Use bounded exponential backoff: 500ms, 1s and 2s.
• Respect request cancellation and deadlines while waiting to retry.
• Avoid retrying permanent token failures such as invalid credentials (401).
• Add regression coverage for temporary DNS failures and permanent authentication failures.

Validation

• gofmt
• go tool golangci-lint run ./...
• go vet ./...
• go test -race ./...
• git diff --check

[Copilot]

Pull request overview

This PR improves OCI/Docker registry authentication robustness by adding retry logic around bearer-token acquisition, aiming to mitigate transient network/DNS failures and certain retryable HTTP responses, with accompanying regression tests.

Changes:

• Add bounded exponential backoff retries for token fetch on transient request failures and on 429 / 5xx responses.
• Refactor token response handling into helpers (decodeTokenResponse, tokenResponseError) and add retry decision helpers.
• Add tests covering temporary DNS failures (retry) and permanent auth failures (no retry).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
internal/httpclient/transport.go	Implements token-request retry loop with backoff, plus helper functions for decoding/errors and retry decisions.
internal/httpclient/transport_test.go	Adds regression tests verifying retries on temporary DNS failures and no retries on 401 responses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[andrew]

Please add regression tests for the new 429/5xx response retries, the four-attempt limit, the 500ms, 1s, and 2s delay sequence through the injected waiter, and cancellation while waiting. Current coverage exercises temporary DNS errors and permanent failures. The HTTP-status and bounded-backoff paths remain untested.

[abhinavgautam01]

Thanks, added regression coverage for 429/5xx retries, the four-attempt limit, the injected 500ms/1s/2s backoff sequence and cancellation while waiting.