fix(ci): retry transient FTP deploy failures (#21)

* fix(ci): retry transient FTP deploy failures

* fix(ci): encode FTP secrets in retry inputs

* fix(ci): mask serialized FTP credentials

* fix(ci): mask encoded FTP credentials before retries

Author: gbzarelli

.github/workflows/deploy.yml

@@ -37,45 +37,77 @@ jobs:
           ls -la out/
           echo "Build output files:"
           find out/ -type f | head -10
+
+      - name: Mask serialized FTP credentials
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        env:
+          FTP_HOST_RAW: ${{ secrets.FTP_HOST }}
+          FTP_USERNAME_RAW: ${{ secrets.FTP_USERNAME }}
+          FTP_PASSWORD_RAW: ${{ secrets.FTP_PASSWORD }}
+        run: |
+          node <<'NODE'
+          const names = ['FTP_HOST_RAW', 'FTP_USERNAME_RAW', 'FTP_PASSWORD_RAW'];
+          const escapeCommandData = (value) => value
+            .replace(/%/g, '%25')
+            .replace(/\r/g, '%0D')
+            .replace(/\n/g, '%0A');
+
+          for (const name of names) {
+            const serialized = JSON.stringify(process.env[name] ?? '');
+            process.stdout.write(`::add-mask::${escapeCommandData(serialized)}\n`);
+          }
+          NODE
       
       - name: Deploy Next.js assets (excluding app chunks)
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-        uses: SamKirkland/FTP-Deploy-Action@v4.3.6
+        uses: Wandalen/wretry.action@v3.8.0
         with:
-          server: ${{ secrets.FTP_HOST }}
-          username: ${{ secrets.FTP_USERNAME }}
-          password: ${{ secrets.FTP_PASSWORD }}
-          local-dir: ./out/_next/
-          server-dir: ./_next/
-          state-name: .ftp-deploy-sync-state.json
-          exclude: |
-            **/static/chunks/app/**
+          action: SamKirkland/FTP-Deploy-Action@v4.3.6
+          attempt_limit: 3
+          attempt_delay: 15000
+          with: |
+            server: ${{ toJSON(secrets.FTP_HOST) }}
+            username: ${{ toJSON(secrets.FTP_USERNAME) }}
+            password: ${{ toJSON(secrets.FTP_PASSWORD) }}
+            local-dir: ./out/_next/
+            server-dir: ./_next/
+            state-name: .ftp-deploy-sync-state.json
+            exclude: |
+              **/static/chunks/app/**
 
       - name: Deploy Next.js app chunks
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-        uses: SamKirkland/FTP-Deploy-Action@v4.3.6
+        uses: Wandalen/wretry.action@v3.8.0
         with:
-          server: ${{ secrets.FTP_HOST }}
-          username: ${{ secrets.FTP_USERNAME }}
-          password: ${{ secrets.FTP_PASSWORD }}
-          local-dir: ./out/_next/static/chunks/app/
-          server-dir: ./_next/static/chunks/app/
-          state-name: .ftp-deploy-sync-state.json
+          action: SamKirkland/FTP-Deploy-Action@v4.3.6
+          attempt_limit: 3
+          attempt_delay: 15000
+          with: |
+            server: ${{ toJSON(secrets.FTP_HOST) }}
+            username: ${{ toJSON(secrets.FTP_USERNAME) }}
+            password: ${{ toJSON(secrets.FTP_PASSWORD) }}
+            local-dir: ./out/_next/static/chunks/app/
+            server-dir: ./_next/static/chunks/app/
+            state-name: .ftp-deploy-sync-state.json
 
       - name: Deploy site files to FTP
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
-        uses: SamKirkland/FTP-Deploy-Action@v4.3.6
+        uses: Wandalen/wretry.action@v3.8.0
         with:
-          server: ${{ secrets.FTP_HOST }}
-          username: ${{ secrets.FTP_USERNAME }}
-          password: ${{ secrets.FTP_PASSWORD }}
-          local-dir: ./out/
-          server-dir: ./
-          exclude: |
-            **/.git*
-            **/.git*/**
-            **/node_modules/**
-            **/.DS_Store
-            **/_next/**
-          dry-run: false
+          action: SamKirkland/FTP-Deploy-Action@v4.3.6
+          attempt_limit: 3
+          attempt_delay: 15000
+          with: |
+            server: ${{ toJSON(secrets.FTP_HOST) }}
+            username: ${{ toJSON(secrets.FTP_USERNAME) }}
+            password: ${{ toJSON(secrets.FTP_PASSWORD) }}
+            local-dir: ./out/
+            server-dir: ./
+            exclude: |
+              **/.git*
+              **/.git*/**
+              **/node_modules/**
+              **/.DS_Store
+              **/_next/**
+            dry-run: false